Senior SASE & Cloud Security Engineer

About the role

A leading bank is looking for a hands-on, analytical Senior Network Security Engineer to lead the architecture, engineering and evolution of a cloud-delivered security edge. You will drive Secure Web Gateway (SWG), Secure Access Service Edge (SASE) and Zero Trust Network Access (ZTNA) transformations so that network connectivity remains robust, secure and seamless.

Key responsibilities

• Design and maintain web security policy architecture (URL filtering, cloud application control, cloud firewall, file-type and sandbox policies).
• Engineer SSL/TLS inspection strategies, exemption frameworks and traffic steering via PAC files, explicit proxies and GRE/IPsec tunnels, and lead the migration of legacy on-premises proxies to cloud SWG.
• Design and build ZTNA to replace remote-access VPNs, integrate identity with corporate IdPs (SAML, SCIM) and implement CASB, DLP and data-protection controls.
• Maintain platform-independent security policy baselines, evaluate vendors technically and automate configuration management via APIs under version control.
• Deliver engineering runbooks for Change Advisory Board reviews and support regulatory audits such as MAS TRM guidelines.

Required profile

• Degree in Computer Science, Information Technology or a related field.
• 8 to 12 years of total experience in network or security engineering, including at least 4 years designing and implementing enterprise SSE/SASE platforms (hands-on engineering, not end-user support).
• Proven success leading at least one migration from an on-premises proxy to a cloud SWG platform.
• Proven experience designing and delivering ZTNA solutions to replace legacy remote-access VPNs.
• Experience operating under the ITIL framework in a regulated environment.

Required skills

• Deep understanding of HTTP/S, TLS and PKI, proxy/PAC file behaviour, DNS and authentication workflows (SAML, Kerberos).
• Identity provider integration (Microsoft Entra ID or Okta via SAML/SCIM) and enterprise firewall work (Palo Alto, Check Point) with GRE/IPsec tunnelling.
• Good-to-have: Zscaler (ZIA/ZPA), Netskope or Skyhigh Security; PoCs and platform evaluations; digital experience monitoring, EDM/IDM and browser isolation; Python or Terraform scripting, Splunk SIEM integration; Intune, SCCM or Jamf endpoint management; financial services background; CISSP, CCSP or vendor certifications.