Technical Specialist-GIT

Job Summary

The Cloud Network & Firewall Engineer - L2 is responsible for the design, implementation, management, and troubleshooting of network and security infrastructure across AWS, Microsoft Azure, and Google Cloud Platform environments. This role operates as an escalation point from L1 support, handling complex incidents, change requests, and proactive improvement initiatives for cloud-native and hybrid network architectures

Key Responsibilities

Multi-Cloud Network Operations

• Design, configure, and manage VPCs (AWS), VNets (Azure), and VPCs (GCP) including subnets, route tables, and peering connections.
• Configure and troubleshoot AWS Transit Gateway, Azure Virtual WAN, and GCP Cloud Router for hub-and-spoke and mesh connectivity.
• Manage BGP and static routing across cloud environments and on-premises interconnects (AWS Direct Connect, Azure ExpressRoute, GCP Cloud Interconnect).
• Maintain DNS resolution strategies including AWS Route 53, Azure Private DNS, and GCP Cloud DNS integration with on-prem resolvers.
• Administer load balancers: AWS ALB/NLB, Azure Application Gateway / Load Balancer, and GCP Cloud Load Balancing.

Firewall & Network Security

• Deploy, configure, and manage cloud-native firewalls: AWS Network Firewall, Azure Firewall (Standard/Premium), and GCP Cloud Armor / Firewall Policies.
• Manage NGFWs in cloud environments including Palo Alto VM-Series, Fortinet FortiGate-VM, and Check Point Cloud Guard where applicable.
• Create and maintain security group (SG) and network ACL (NACL) policies in AWS; NSG and ASG rules in Azure; VPC firewall rules and hierarchical policies in GCP.
• Perform firewall policy reviews, rule optimization, and access path analysis to enforce least-privilege principles.
• Investigate and resolve firewall-related incidents, including blocked traffic, misconfigurations, and policy conflicts.
• Configure and manage WAF policies across AWS WAF, Azure WAF, and GCP Cloud Armor for application-layer protection.

Incident & Change Management

• Act as L2 escalation point for network and firewall incidents triaged by L1 support.
• Diagnose and resolve complex issues including packet loss, asymmetric routing, MTU mismatches, VPN instability, and latency spikes.
• Raise, assess, and implement change requests following ITIL-based change management processes (ServiceNow or equivalent ITSM tools).
• Maintain detailed RCA (Root Cause Analysis) documentation for major incidents.
• Participate in on-call rotations and provide timely resolution within defined SLA windows.

Connectivity & Hybrid Networking

• Manage site-to-site and client VPN solutions: AWS Client VPN / Site-to-Site VPN, Azure VPN Gateway / Point-to-Site, and GCP Cloud VPN (HA VPN).
• Implement and maintain SD-WAN overlays and cloud on-ramps where applicable.
• Manage private connectivity services and ensure redundancy via dual tunnels, BGP failover, and cross-AZ/zone resilience.
• Coordinate with ISPs, colocation providers, and WAN vendors for circuit provisioning and fault resolution.

Monitoring, Alerting & Automation

• Utilize native monitoring tools: AWS CloudWatch / VPC Flow Logs, Azure Monitor / NSG Flow Logs, and GCP Cloud Logging / Network Intelligence Center.
• Configure network-layer alerts and dashboards using tools such as Splunk, Grafana, or Dynatrace.
• Leverage infrastructure-as-code (IaC) for network provisioning using Terraform, AWS CloudFormation, or Azure Bicep.
• Develop automation scripts (Python/Bash/PowerShell) for firewall rule lifecycle management, report generation, and network audit tasks.
• Support AIOps-driven network automation initiatives including anomaly detection, auto-remediation workflows, and proactive health reporting.

Documentation & Compliance

• Maintain accurate and up-to-date network diagrams, IP address management (IPAM) records, and runbooks.
• Ensure cloud network configurations comply with CIS Benchmarks, NIST, ISO 27001, or client-specific security standards.
• Participate in internal and external security audits; provide evidence and remediation for network-related findings.
• Contribute to knowledge base articles and post-implementation reviews.

Skill Requirements

Required Skills & Qualifications

Experience

• 3-6 years of hands-on experience in network and/or network security engineering.
• Minimum 2+ years of demonstrated experience in at least two of the three major cloud platforms: AWS, Azure, or GCP.
• Proven experience managing firewalls in cloud environments (native and/or NGFW).

Technical Skills

Category

Skills & Tools

AWS Networking

VPC, TGW, Direct Connect, Route 53, ALB/NLB, AWS Network Firewall, AWS WAF, Security Groups, NACLs, CloudWatch, VPC Flow Logs

Azure Networking

VNet, VNet Peering, ExpressRoute, VPN Gateway, Azure Firewall, Azure WAF, NSG, ASG, Azure Monitor, Network Watcher

GCP Networking

VPC, Cloud Router, Cloud Interconnect, Cloud VPN (HA VPN), GCP Firewall Rules, Cloud Armor, VPC Flow Logs, Network Intelligence Center

Network Protocols

TCP/IP, BGP, OSPF, EIGRP, VLAN/802.1Q, STP, QoS, NAT/PAT, IPv4/IPv6, MPLS basics

Firewall Platforms

Palo Alto (PAN-OS), Fortinet FortiGate, Check Point, Cisco ASA/FTD (familiarity), AWS/Azure/GCP native firewalls

Security Concepts

Zero Trust, microsegmentation, least-privilege access, ZTNA, DDoS protection, IDS/IPS, TLS inspection

Automation & IaC

Terraform, Python/Bash scripting, AWS CloudFormation, Azure Bicep, Ansible (preferred)

ITSM Tools

ServiceNow, Jira, Remedy - change management, incident handling, CMDB updates

Monitoring Tools

Splunk, Grafana, Dynatrace, SolarWinds, CloudWatch, Azure Monitor

Preferred Certifications

Amazon Web Services (AWS)

Microsoft Azure

Google Cloud Platform (GCP)

• AWS Certified Advanced Networking - Specialty
• AWS Certified Security - Specialty
• AWS Solutions Architect - Associate / Professional

• AZ-700: Azure Network Engineer Associate
• AZ-500: Azure Security Engineer Associate
• AZ-104: Azure Administrator Associate

• Google Professional Cloud Network Engineer
• Google Professional Cloud Security Engineer
• Google Associate Cloud Engineer

Other Requirements

Preferred Certifications

Amazon Web Services (AWS)

Microsoft Azure

Google Cloud Platform (GCP)

• AWS Certified Advanced Networking - Specialty
• AWS Certified Security - Specialty
• AWS Solutions Architect - Associate / Professional

• AZ-700: Azure Network Engineer Associate
• AZ-500: Azure Security Engineer Associate
• AZ-104: Azure Administrator Associate

• Google Professional Cloud Network Engineer
• Google Professional Cloud Security Engineer
• Google Associate Cloud Engineer

Additional valued certifications: CCNP Enterprise/Security, Palo Alto PCNSE, Fortinet NSE 4/7, CISSP, CompTIA Security+