Senior Cybersecurity Engineer - Secure Access Network

About the role

Roche's Network Security product protects its connectivity through policy-driven processes that identify, inspect and mitigate network risks, manage regulatory compliance and oversee ingress and egress traffic. As a Senior Cybersecurity Engineer (Network Security) in the Network Security Product area, you will be the primary Subject Matter Expert for Secure Access Network Services, leading the evolution of Network Access Control, identity-driven security, segmentation and authentication across Roche's global enterprise. You will help keep Roche's network resilient and compliant through its "Defense in Depth" strategy.

Key responsibilities

• Act as SME for Secure Access technologies, evaluate emerging security tools and define the long-term technical roadmap aligned with Roche's Zero Trust architecture.
• Partner with business units to turn security requirements into technical initiatives and functional policies, and mentor junior engineers.
• Design, deploy and maintain authentication solutions (802.1X, EAP-TLS, EAP-TEAP, RADIUS, TACACS+, SAML, MFA) and integrate them with enterprise Identity Providers.
• Manage Cisco ISE deployments end to end, including upgrades, capacity planning and optimization, and develop endpoint profiling for corporate, medical and IoT devices.
• Implement access control mechanisms (Dot1x, MAB, Guest Access, posture-based authorization) and Cisco TrustSec/SGT micro-segmentation.
• Escalate complex incidents, build observability dashboards, advocate Infrastructure-as-Code and automation, and build API-driven integrations and self-service tools.
• Ensure secure connectivity for tens of thousands of endpoints worldwide and collaborate with globally distributed product squads.

Required profile

• Bachelor's degree in Computer Science, Software Engineering, Information Security or a related field.
• 5+ years of hands-on experience designing, implementing and managing enterprise-grade NAC solutions, specifically Cisco ISE.
• Proven track record deploying Palo Alto NGFWs from scratch, including SSL decryption and threat prevention.
• Experience using Ansible/Terraform and Python to manage network security infrastructure at scale.
• Experience in complex, global environments with thousands of device profiles (IoT, medical, corporate); experience in pharmaceuticals, healthcare or finance is a significant plus.
• Ability to mentor junior engineers and communicate complex security concepts to non-technical stakeholders.

Required skills

• Cisco ISE expert, including TrustSec, Dot1x, MAB, profiling, guest portals, REST APIs, EAP-TLS/EAP-TEAP, RADIUS and TACACS+.
• Palo Alto firewall deployment and troubleshooting in active/active and active/passive HA setups.
• Network virtualization and segmentation (TrustSec, SGTs, VRFs).
• Plus: IaC with Terraform and GitHub, CI/CD pipelines with GitLab/GitHub, Python/PowerShell/Bash scripting, enterprise networking (BGP, OSPF, VLANs, VXLAN).