Technical Specialist-GIT

Job Summary

The Cloud Network & Firewall Engineer - L3 is a senior technical authority responsible for the end-to-end architecture, governance, and continuous improvement of multi-cloud network and security infrastructure across AWS, Microsoft Azure, and Google Cloud Platform. This role goes beyond operational management: the L3 engineer drives strategic network design decisions, leads complex technical escalations from L1/L2 teams, defines standards and reference architectures, and acts as a bridge between engineering execution and organizational leadership. The role requires deep expertise across cloud-native networking, advanced firewall technologies, automation engineering, and compliance frameworks

Key Responsibilities

Multi-Cloud Network Architecture & Design Architect enterprise-grade multi-cloud and hybrid network topologies including hub-and-spoke, full mesh, and multi-region active-active designs across AWS, Azure, and GCP. Define reference architectures for VPC/VNet segmentation, transit routing, and shared services models aligned to business and compliance requirements. Lead the design and implementation of advanced routing strategies using BGP with communities, route filtering, and policy-based routing across cloud and on-premises environments. Architect and oversee private connectivity: AWS Direct Connect (hosted and dedicated), Azure ExpressRoute (circuits, Global Reach, Fast Path), and GCP Cloud Interconnect (VLAN attachments, Partner Interconnect). Design DNS architectures including split-horizon DNS, conditional forwarding, and resolver endpoint strategies across AWS Route 53 Resolver, Azure Private DNS Resolver, and GCP Cloud DNS. Establish IP address management (IPAM) strategy and governance across multi-cloud environments, preventing overlap and enabling scalable growth. Evaluate and recommend network service mesh and service-level networking solutions for microservices and Kubernetes workloads. Advanced Firewall Architecture & Security Design Design and govern enterprise firewall policy frameworks across AWS Network Firewall, Azure Firewall Premium, GCP Cloud Armor, and third-party NGFWs (Palo Alto, Fortinet, Check Point). Architect zero-trust network access (ZTNA) models, micro segmentation strategies, and east-west traffic inspection across cloud environments. Define and enforce security group, NSG, and VPC firewall rule standards at scale using policy-as-code, tagging, and automated compliance checks. Lead threat landscape analysis for cloud network environments; design DDoS mitigation, IDS/IPS placement, and anomaly detection architectures. Oversee WAF rule strategy and tuning across AWS WAF, Azure WAF, and GCP Cloud Armor, including OWASP rule sets, rate limiting, and bot management. Conduct architectural security reviews and threat modelling sessions for new cloud deployments and network design changes. Evaluate and deploy TLS/SSL inspection architectures within cloud firewall services while managing certificate lifecycle. Technical Leadership & Escalation Serve as the final technical escalation point (L3) for critical, complex, or unresolved network and firewall incidents from L1/L2 teams. Lead war-room bridges for P1/P2 incidents; drive rapid root cause identification and coordinate cross-functional resolution. Conduct deep-packet analysis, flow analysis, and advanced diagnostics for persistent or elusive network issues. Produce high-quality post-incident reports and architecture improvement recommendations to prevent recurrence. Review and approve complex change requests; provide technical risk assessment for high-impact changes. Mentor and coach L1/L2 engineers; develop internal knowledge through structured sessions, runbooks, and design documents. Governance, Compliance & Standards Define, publish, and maintain cloud network architecture standards, design patterns, and guardrails for the organization. Ensure all cloud network configurations adhere to CIS Benchmarks, NIST SP 800-53, ISO 27001, SOC 2, PCI-DSS, and relevant industry frameworks. Lead network-related workstreams in internal and external audits; own remediation plans and track closure of findings. Establish network security baselines and conduct periodic posture assessments using cloud-native tools (AWS Security Hub, Microsoft Defender for Cloud, GCP Security Command Center). Contribute to data residency, sovereignty, and regulatory compliance strategies for multi-region cloud deployments. Vendor, Stakeholder & Program Management Engage with AWS, Microsoft Azure, and GCP technical account teams for roadmap alignment, architectural guidance, and issue escalation. Evaluate and lead procurement decisions for network tooling, NGFW platforms, S

Skill Requirements

Required Skills & Qualifications

Experience

• 7-12 years of progressive experience in network engineering, with a strong focus on cloud and hybrid environments.
• Minimum 4+ years of hands-on, production-level experience across at least two of the three major cloud platforms: AWS, Azure, or GCP.
• Demonstrated experience architecting and governing enterprise-scale multi-cloud network and firewall solutions.
• Track record of leading complex incident resolution, architectural reviews, and cross-functional technical programs.

Technical Skills Matrix

Category

Skills, Platforms & Depth

AWS Networking (Expert)

VPC advanced design, TGW + inter-region peering, Direct Connect (LAG, failover), Route 53 Resolver, AWS Network Firewall (Suricata rules), AWS WAF (custom rules), Gateway Load Balancer (GWLB), IPv6 dual-stack, AWS PrivateLink at scale, VPC Reachability Analyzer

Azure Networking (Expert)

vWAN (secured hub, routing intent), ExpressRoute (Global Reach, FastPath, MACsec), Azure Firewall Premium (IDPS, TLS inspection), Azure WAF (custom rules, bot protection), Private Endpoint governance, Virtual Network Manager, Azure Network Watcher advanced diagnostics

GCP Networking (Expert)

Shared VPC, hierarchical firewall policies, Cloud NAT HA design, HA VPN (dynamic routing), Cloud Interconnect (VLAN attachments, MED tuning), Cloud Armor advanced rules (Adaptive Protection), Network Connectivity Center, Private Service Connect, Network Intelligence Center

Network Protocols (Advanced)

BGP (multi-path, communities, route-maps, policy), OSPF, EIGRP, advanced NAT/PAT, QoS, MPLS/SR-MPLS concepts, BFD, ECMP, GRE/IPsec tunnelling, PBR, IPv4/IPv6 dual-stack

Firewall & Security (Expert)

Palo Alto PAN-OS (Panorama, App-ID, User-ID, SSL-TI, Wildfire), Fortinet FortiGate (FortiManager, FortiAnalyzer), Check Point (SmartConsole, R81.x), Zero Trust architecture, microsegmentation, ZTNA, cloud-native NGFWs

Security & Compliance

CIS Benchmarks, NIST SP 800-53, ISO 27001, PCI-DSS, SOC 2, AWS Security Hub, Microsoft Defender for Cloud, GCP SCC, cloud posture management (CSPM)

ITSM & Leadership

ServiceNow (change, incident, CMDB, ITOM), ITIL v4 practitioner, Agile/Scrum, technical documentation, pre-sales support, stakeholder management

Other Requirements

Required & Preferred Certifications

Amazon Web Services (AWS)

Microsoft Azure

Google Cloud Platform (GCP)

• AWS Certified Advanced Networking - Specialty (Required)
• AWS Certified Security - Specialty
• AWS Solutions Architect - Professional

• AZ-700: Azure Network Engineer Associate (Required)
• AZ-500: Azure Security Engineer Associate
• AZ-305: Azure Solutions Architect Expert

• Google Professional Cloud Network Engineer (Required)
• Google Professional Cloud Security Engineer
• Google Professional Cloud Architect

Additional highly valued certifications: CCIE Enterprise / Data Center / Security, Palo Alto PCNSE, Fortinet NSE 7/8.

L3 Differentiators (What Sets This Role Apart from L2)

Dimension

L2 Scope

L3 Scope (This Role)

Escalation

Handles L1 escalations; resolves most incidents independently

Final escalation point; resolves novel, critical, and complex issues with no precedent

Architecture

Implements defined designs; proposes improvements

Owns end-to-end reference architectures; sets organizational standards

Automation

Writes scripts and uses IaC for provisioning tasks

Designs automation frameworks; builds CI/CD pipelines; drives AIOps strategy

Security Design

Manages firewall rules and security policy execution

Defines zero-trust strategy; leads threat modelling; governs posture at scale

Leadership

Mentors peers; contributes to knowledge base

Coaches L1/L2 teams; leads design reviews; engages senior stakeholders

Vendor Engagement

Raises tickets with vendor support

Leads vendor architectural discussions; influences product roadmaps

Compliance

Applies existing compliance controls to configurations

Defines compliance frameworks; leads audit engagements; owns remediation programs

Behavioral & Leadership Competencies

• Exceptional analytical depth - ability to reason through novel, undocumented, or multi-system problems independently.
• Executive-level communication: capable of translating complex technical risk into business-impact language for senior stakeholders.
• Influential leadership - drives consensus and technical direction across cross-functional teams without direct authority.
• Strong ownership mindset - takes accountability for architectural outcomes, not just task completion.
• Continuous learning orientation - proactively tracks cloud platform releases, threat intelligence, and industry trends.
• Mentorship and talent development - invests in building capability within the wider network engineering team.
• Comfortable operating with ambiguity in fast-evolving environments with competing priorities.