Cybersecurity Engineer - Network Security (Cisco ISE, Palo Alto, Observability)

About the role

Roche's Network Security product protects its connectivity through policy-driven processes that identify, inspect and mitigate network risks, manage regulatory compliance and control egress/ingress traffic. As Subject Matter Expert for Network Security, you will lead the design, build and improvement of critical security infrastructures, focusing on Cisco ISE, Wired Access Control (WAC) and Palo Alto Networks, while also engineering a custom observability framework.

Key responsibilities

• Lead the design and architecture of global Cisco ISE and WAC deployments, and act as primary engineer for Palo Alto NGFW architectures, including threat prevention, decryption and secure traffic management.
• Identify gaps in the security posture and improve NAC policies, SGT (TrustSec) propagation and firewall rule sets.
• Lead complex global migrations and new feature rollouts across the network security stack.
• Build a custom observability framework with front-end and back-end development, and integrate CMDB, IPAM and other data sources for a real-time asset inventory.
• Design telemetry ingestion and visualization from ISE, WAC and Palo Alto using APIs, SNMP and Syslog.
• Provide root-cause analysis for escalations, build dashboards and reporting, and manage security policies as code with improved automation and orchestration.
• Design self-service capabilities so internal teams can use network security controls autonomously and securely.

Required profile

• Bachelor's degree in Computer Science, Software Engineering, Information Security or a related field.
• 3+ years of hands-on experience designing, implementing and managing enterprise-grade NAC solutions, specifically Cisco ISE.
• Proven experience configuring and maintaining Palo Alto NGFWs, including SSL decryption and threat prevention.
• Experience managing security controls in complex, global environments with thousands of device profiles (IoT, medical, corporate).
• Experience in regulated industries such as pharmaceuticals, healthcare or finance is a significant plus.
• Ability to mentor colleagues and communicate complex security concepts to non-technical stakeholders.

Required skills

• Cisco ISE, including TrustSec, Dot1x, MAB and Profiling.
• Ansible, Terraform or Python for infrastructure automation at scale.
• REST API integrations between security platforms.
• Palo Alto firewalls in complex HA environments (Active/Active and Active/Passive).
• RADIUS, TACACS+, and core routing/switching fundamentals.
• LogicMonitor, Splunk or similar tools for custom dashboards and data sources.
• Plus: IaC with Terraform and GitHub, CI/CD pipelines, and enterprise networking (BGP, OSPF, VLANs, VXLAN).