Senior Cybersecurity Engineer - Edge Network Security

About the role

Roche's Network & Perimeter Security product protects its connectivity through policy-driven processes, identifying, inspecting and mitigating network risks and managing egress/ingress traffic. As a Senior Cybersecurity Engineer (Edge Defense), you will own the end-to-end lifecycle of the Edge security stack, including Next-Generation Firewalls, DDoS mitigation and Zero Trust Network Access, turning perimeter controls into scalable, code-driven security services.

Key responsibilities

• Deploy, configure and maintain Next-Generation Firewalls (Palo Alto, Fortinet) with high availability and optimal inspection performance at global entry points.
• Architect and implement Zero Trust Network Access solutions to replace legacy VPNs, with granular, application-level access and identity-aware policies.
• Engineer cloud-native security controls in AWS, Azure and GCP for hybrid and multi-cloud environments.
• Design DDoS protection strategies and automated threat prevention policies (SSL decryption, IPS/IDS).
• Oversee Edge solutions from design through build, rollout and optimization, and follow emerging Edge and SASE trends for the product roadmap.
• Lead escalations with deep-packet analysis and root-cause investigation, and build monitoring dashboards and telemetry.
• Manage security policies as code, improve automation and orchestration, and build APIs so dev teams can request firewall rules autonomously.
• Work on-call on a rotating schedule.

Required profile

• Bachelor's degree in Computer Science, Software Engineering, Information Security or a related field.
• 5+ years of hands-on experience designing and managing enterprise-grade firewall environments (Palo Alto and/or Fortinet).
• Proven implementation of network security controls in at least two major cloud providers (AWS, Azure or GCP).
• Experience with Ansible, Terraform or Python to manage security infrastructure at scale.
• Experience in complex, global environments with thousands of device profiles; regulated industries such as pharma, healthcare or finance are a plus.

Required skills

• Palo Alto and/or Fortinet NGFW, including TLS inspection, SSL decryption, WildFire, Threat Prevention, URL Filtering and GlobalProtect.
• DDoS mitigation services (Akamai, Cloudflare, F5).
• Zero Trust and SASE (Zscaler, Prisma Access).
• Cloud networking (VPCs, VNETs, Transit Gateways, Cloud Firewalls) and protocols (BGP, OSPF, DNS, TLS/SSL).
• Plus: Fortinet NSE, Palo Alto PCNSA, Cisco CCNP Security, CISSP, Terraform, Python or Go, NIST/ISO 27001/FAIR.