{"id":169387,"url":"https://alion.io/job/roche-cybersecurity-engineer-for-network-security","title":"Cybersecurity Engineer for Network Security","company":{"id":13531,"name":"Roche","domain":"roche.com","url":"https://alion.io/company/roche","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":86,"open_postings":187,"ghost_share":0.027,"stale_share":0.679,"repost_share":0.043,"time_to_fill_p50_days":19,"computed_at":"2026-10-28T05:59:10Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Madrid, Spain"],"countries":["ES"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":37000,"max_usd":91000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":854},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Ansible","optional":false},{"name":"Defense in Depth","optional":false},{"name":"Matter","optional":false},{"name":"Palo Alto NGFW","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"Splunk","optional":false},{"name":"Terraform","optional":false},{"name":"VPN","optional":false},{"name":"BGP","optional":true},{"name":"CI/CD","optional":true},{"name":"OSPF","optional":true}],"status":"live","first_seen_at":"2026-06-15T00:00:00Z","employer_posted_date":"2026-06-15","last_verified_at":"2026-10-28T07:14:45Z","board_verified":true,"closed_at":null,"days_open":135,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":135},"description":"At Roche you can show up as yourself, embraced for the unique qualities you bring. Our culture encourages personal expression, open dialogue, and genuine connections, where you are valued, accepted and respected for who you are, allowing you to thrive both personally and professionally. This is how we aim to prevent, stop and cure diseases and ensure everyone has access to healthcare today and for generations to come. Join Roche, where every voice matters.\nThe Position\nThe Network Securityproduct makes Roche’s connectivity accessible and secure through actionable, policy-driven processes. The capabilities we provide enable Roche to identify, inspect, and mitigate network-based risks, manage regulatory compliance, and oversee egress/ingress traffic across all layers. Our solutions are primarily instantiated through leading-edge security platforms and automated orchestration. We work closely with Cloud, Infrastructure, and Incident Response teams to provide enterprise visibility into Roche’s network security posture.\nYou’ll be working within the Network Security Productarea. This area is accountable for the end-to-end delivery of solutions-designing, building, and maintaining the technologies that protect Roche networks and the Internet, whether on-prem or cloud-based. This includes continuous improvement of capabilities like Internet Security Stack, DDoS Protection, Site-to-Site Connectivity (VPN), Network Access Control and Deep Packet Inspectionto stay ahead of an ever-evolving threat landscape.\nAs the Subject Matter Expert (SME) for Network Security, you will lead the Design, Build, and Improvement of critical security infrastructures, specifically focusing on Cisco ISE, Wired Access Control (WAC), and Palo Alto Networks. This is a dual-impact role: you are the technical authority for the secure access layer, while simultaneously leading the engineering of a custom observability framework. You will develop the front-end, back-end, and integration logic required to provide deep visibility into the security product health and asset inventory.\nJob Responsibilities\n1. SME:\nSecure Access (ISE, WAC, Palo Alto)\nDesign & Architecture: Lead the high-level and low-level design (HLD/LLD) for global Cisco ISE deployments and Wired Access Control (WAC) strategies to ensure seamless, identity-based security.\n\nPalo Alto SME: Serve as the primary engineer for Palo Alto NGFW architectures, including advanced threat prevention, decryption, and secure egress/ingress traffic management.\n\nContinuous Improvement: Proactively identify gaps in the current security posture and implement technical enhancements to NAC policies, SGT (TrustSec) propagation, and firewall rule-sets.\n\nBuild & Implementation: Act as the lead \"implementer\" for complex global migrations and new feature rollouts across the network security stack.\n\n2. Observability Framework Engineering\nFull-Stack Development:Architect and develop a custom framework (front-end and back-end) to provide a \"single pane of glass\" for infrastructure health.\n\nInventory & Integration:Build automated integrations with external data sources (CMDB, IPAM, etc.) to maintain a real-time, dynamic inventory of all network assets and security nodes.\n\nTelemetry Logic:Design custom logic to ingest and visualize telemetry from ISE, WAC, and Palo Alto using APIs, SNMP, and Syslog.\n\n3. Operational Excellence & Visibility\nTechnical Subject Matter Expertise:Serve as the lead engineer for complex network security escalations, providing root-cause analysis and implementing long-term, automated architectural fixes.\n\nSecurity Observability:Develop dashboards and reporting to provide real-time visibility into the \"connected landscape,\" identifying insecure nodes or unauthorized devices before they can affect the network.\n\nAutomation & Orchestration:Manage security policies as code while continuously improving automation workflowsand cross-platform orchestrationto eliminate manual friction, reduce operational overhead, and ensure consistent, high-speed security enforcement.\n\nSelf-Service & Enablement:Design and build self-service capabilitiesthat empower internal teams to consume network security controls autonomously and securely.\n\n Qualifications\nEducation / Experience\nEducational Background:Bachelor’s degree in Computer Science, Software Engineering, Information Security, or a related technical field.\n\nNetwork Access Control Mastery:3+ years of hands-on experience in designing, implementing, and managing enterprise-grade NAC solutions, specifically Cisco ISE.\n\nPerimeter & Inspection Expertise:Proven track record in configuring and maintaining Palo Alto Next-Generation Firewalls (NGFW), including SSL decryption and threat prevention.\n\nAutomation Engineering:Proven experience using Ansible, Terraform, or Pythonto manage network security infrastructure at scale.\n\nLarge-Scale Infrastructure:Experience managing security controls in complex, global environments involving thousands of diverse device profiles (IoT, Medical, Corporate).\n\nRegulated Industry:Experience working in highly regulated environments (e.g., Pharmaceuticals, Healthcare, or Finance) is a significant plus.\n\nTechnical Skills\nCisco ISE Specialist:Expert-level knowledge of Cisco ISE, including hands-on experience with TrustSec, Dot1x, MAB, and Profiling.\n\nCoding & Integration:Strong scripting skills in Python, PowerShell, or Bashto develop self-service tools and custom API integrations between security platforms. API integrations between security platforms.\n\nAPI & Integration:Deep experience with REST APIs for integrating security platforms with external information sources.\n\nSegmentation Technologies:Proficiency in network virtualization and segmentation techniques (such as TrustSec, SGTs, or VRFs) applied to security use cases.\n\nPalo Alto Mastery:Proven track record in deploying and troubleshooting Palo Alto Firewallsin complex HA environments (Active/Active and Active/Passive).\n\nNetwork Foundations:Deep understanding of RADIUS, TACACS+, and core routing/switching as they relate to security enforcement.\n\nMonitoring Stack:Advanced knowledge of LogicMonitor, Splunk, or similar tools, specifically for creating custom DataSources and Dashboards.\n\nArchitectural Mindset:Ability to design \"Defense in Depth\" flows that connect device identity to granular network permissions.\n\nSkills below will be considered a plus:\n\nInfrastructure as Code (IaC):Proficiency in Terraformand GitHubto design and manage reproducible, version-controlled network security configurations.\n\nEngineering & Orchestration:Proven ability to build CI/CD pipelinesand automated workflows that streamline cross-platform security operations and eliminate manual friction.\n\nEnterprise Networking:Solid foundation in enterprise networking (L2/L3), including advanced knowledge of routing protocols (BGP, OSPF) and switching (VLANs, VXLAN) to ensure seamless security policy integration.\n\nLeadership Skills\nCommunication:Strong ability to build trust with network and infrastructure experts and explain complex security policy concepts to non-technical stakeholders.\n\nInnovation & Curiosity:A relentless passion for staying ahead of threat actors by researching emerging network security trends and automated enforcement techniques.\n\nThriving in Ambiguity:Ability to navigate global complexity and drive clarity when translating high-level security requirements into functional network policies.\n\nSelf-Starter:Proven ability to manage technical workstreams from concept to production with minimal supervision, taking full ownership of the NAC product lifecycle.\n\nAdditional Qualifications\nDemonstrated ability to mentor colleagues with less experience and provide guidance on cybersecurity best practices and analysis techniques\n\nStrong facilitation, communication, and conflict resolution skills to ensure alignment across multiple product squads and complex stakeholder networks\n\nDemonstrated interpersonal, collaborative and commitment to operational excellence skills.\n\nWho we are\nA healthier future drives us to innovate. Together, more than 100’000 employees across the globe are dedicated to advance science, ensuring everyone has access to healthcare today and for generations to come. Our efforts result in more than 26 million people treated with our medicines and over 30 billion tests conducted using our Diagnostics products. We empower each other to explore new possibilities, foster creativity, and keep our ambitions high, so we can deliver life-changing healthcare solutions that make a global impact.\nLet’s build a healthier future, together.\nRoche is an Equal Opportunity Employer.","description_format":"text","description_chars":8646,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Network Security","Information Security","Biologics & Biosimilars"],"lifecycle":[{"event":"open","at":"2026-08-29T21:31:05Z"}],"visa":[],"liveness":{"score":3,"band":"cold","label":"Long shot","p_open":1,"p_active":0.115,"p_room":0.28,"age_days":135,"expected_fill_days":19,"reasons":["conf:4","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-28T05:59:10Z"},"pay":null,"html_url":"https://alion.io/job/roche-cybersecurity-engineer-for-network-security","json_url":"https://alion.io/job/roche-cybersecurity-engineer-for-network-security.json","meta":{"generated_at":"2026-10-28T08:04:18Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":10397,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-29T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":13531},"rest":"https://alion.io/mcp/rest/get_company?id=13531"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Froche-cybersecurity-engineer-for-network-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Froche-cybersecurity-engineer-for-network-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Froche-cybersecurity-engineer-for-network-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/roche-cybersecurity-engineer-for-network-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Froche-cybersecurity-engineer-for-network-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":169387}},{"tool":"search_jobs","arguments":{"company":"roche.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":169387},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}