Senior Cisco Security Engineer

Requisition Number: 106888

Senior Cisco Security Engineer

Salary: Dependent on experience, the salary is up to 175k a year + full benefits

Travel: 25% of travel to client sites is required

*Seeking candidates that reside in the western region of the United States**

About the role

Insight delivers managed infrastructure, operations and security services for some of the most recognizable brands in North America. Many of the large enterprise clients we support are moving IT operations from reactive, ticket-driven support to a product-aligned platform engineering model, where platforms are treated as products, work is planned in sprints, and anything that can be declared, verified, and remediated is automated. We are adding a senior security engineer to our managed Platform Engineering team to close a critical skill gap across Cisco Systems security stack and to build security directly into the platform design and release cycle.

Along the way, you will get to:

• Serve as the program’s subject-matter expert and engineer for Cisco security platforms: Cisco Umbrella, Cisco Secure Access, Cisco Secure Firewall / Firepower (FMC and FTD), and Cisco Identity Services Engine (ISE).
• Lead the security engineering for the Umbrella-to-Cisco Secure Access migration, including DNS-security policy migration, Secure Client rollout, lab/pilot/production validation, and working with Cisco Lifecycle Services resources.
• Support evaluation and migration of on-premises Firepower Management Center to cloud-delivered FMC via Cisco Security Cloud Control, and of FTD remote-access VPN to Secure Access VPNaaS.
• Support ISE engineering and roll-out program: policy design, posture and profiling, network access control, upgrades and patching, and contribution to ISE Phase 2 project work.
• Drive secure lifecycle management of the Cisco security stack: assess Cisco PSIRT advisories, plan and execute upgrades and patches, and keep configurations aligned to best practice.
• Act as a contributing engineer to the Platform Engineering code base: build automation, infrastructure-as-code and policy-as-code that codifies security standards and recurring maintenance for the Cisco platforms, and ship it through the team's feature release cadence.
• Translate security policies and requirements set by Insight's Managed Security team into implemented, codified controls on deployed platforms; be the bridge between security operations and the infrastructure/platform teams.
• Plan and track security engineering work in the authoritative ticket management system as part of two-week sprints; document designs, standards and runbooks.
• Contribute to platform design reviews so new features and services are secure by design.
• Contribute to identity and access management improvements (ISE, Duo, Active Directory / Microsoft Entra ID) as the client's identity program matures.

Be AmbITious: This opportunity is not just about what you do today but also about where you can go tomorrow. When you bring your hunger, heart, and harmony to Insight, your potential will be met with continuous opportunities to upskill, earn promotions, and elevate your career.

What we’re looking for:

• 7+ years in network or security engineering, with at least 3 years hands-on engineering (design, deployment, migration, not just administration) of enterprise Cisco security products.
• Deep, hands-on experience with Cisco ISE (802.1X, MAB, posture, profiling, TACACS+, pxGrid, policy sets, distributed deployments, upgrades).
• Hands-on experience with Cisco Secure Firewall / Firepower (FMC and FTD): access control and intrusion policy, NAT, remote-access VPN, HA, upgrades.
• Working experience with Cisco Umbrella and/or Cisco Secure Access (DNS security, SWG, ZTNA/SSE) or a comparable SASE/SSE platform such as Palo Alto Prisma or Zscaler.
• Automation and coding skills: Python plus at least one of the following: Ansible or Terraform. Comfortable working with REST APIs (FMC, ISE, Umbrella/Secure Access APIs).
• Working knowledge of Git-based workflows and CI/CD pipelines; experience contributing to a shared code base with code review.
• Experience working in Agile/Scrum teams using Jira, Confluence, and/or ServiceNow.
• Strong written and verbal communication; able to work directly with client engineering leaders.

Preferred qualifications:

• Identity and access management experience: Microsoft Entra ID / Active Directory, Cisco Duo MFA, conditional access, privileged access management, identity governance.
• Cisco Security Cloud Control, cloud-delivered FMC, or Secure Access VPNaaS migration experience.
• Cisco Secure Network Analytics (Stealthwatch), Cisco ThousandEyes, or Cisco Secure Endpoint.
• Familiarity with OT/manufacturing network environments, or willingness to learn.
• Understanding of platform engineering, SRE, GitOps or DevSecOps frameworks.
• Certifications: CCNP Security, CCIE Security, Cisco ISE / SCOR / SNCF specialist; CISSP or similar a plus.
• Managed services or client-facing consulting experience.
• Palo Alto experience preferred.

Insight is an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability status, protected veteran status, sexual orientation or any other characteristic protected by law.

Insight does not accept unsolicited resumes from recruiters or employment agencies. Unsolicited resumes will be treated as direct applications from the candidate, and recruiters or agencies who submit candidates for this position without a prior, written vendor agreement will not be eligible for any form of compensation, even if the candidate is hired.

Posting Notes: San Francisco || California (US-CA) || United States (US) || Engineering || None || Remote ||