Network Engineer – Deployment and Support

About the Job

As 'Network Engineer - Deployment and Support' within our Digital Technology Service Quality team, you will deploy, and support the enterprise network that connects Sanofi - LAN and WAN, WLAN, data center fabric, SD-WAN, and cloud networking across AWS and Azure. You will deploy infrastructure as code using Terraform, Ansible, and Python wherever the platform allows, and apply the same engineering rigor where it does not. You will own what you deploy - from design validation and automated pre-change checks through to day-two operations, capacity management, and incident response - ensuring our network estate remains accurate, performant, resilient, and ready for AI-enabled operations. Ready to get started?

Our Team

Digital Technology - Service Quality is at the heart of Sanofi's digital transformation. We deliver secure, resilient, and scalable infrastructure services that power business-critical applications and enable thousands of users across the enterprise. Our network engineering team owns the connectivity that every other service depends on - spanning offices, laboratories, manufacturing sites, data centers, and multiple cloud providers. Our team combines modern cloud platforms, automation-first engineering, and service excellence to support Sanofi's mission of chasing the miracles of science.

About Sanofi

We're an R&D-driven, AI-powered biopharma company committed to improving people's lives and delivering compelling growth. Our deep understanding of the immune system - and innovative pipeline - enables us to invent medicines and vaccines that treat and protect millions of people around the world. Together, we chase the miracles of science to improve people's lives.

Main Responsibilities

Network Deployment - Infrastructure as Code and Automation

• Deploy cloud network infrastructure as code using Terraform, provisioning virtual networks and VPCs, subnets, route tables, peering, transit gateway and virtual WAN hubs, VPN gateways, and ExpressRoute and Direct Connect attachments across AWS and Azure, with reusable modules, remote state management, and plan review built into the change process
• Deploy and maintain network configuration as code using Ansible, building reusable roles and templates for Cisco IOS and NX-OS, FortiOS, and Junos devices so that every deployment is repeatable, version-controlled, and auditable
• Automate network provisioning and operational tasks in Python, consuming platform APIs - Cisco APIC for ACI fabric, Junos Space for Juniper estate management, Prisma SD-WAN and FatPipe controllers, and F5, Array, and AVI load balancer APIs
• Automate vendor web consoles and portals that expose no usable API using Selenium, so that carrier portals, licensing, and legacy management interfaces do not force manual work
• Use NEXUS as an AI agent within the engineering workflow to accelerate configuration generation and peer review, triage large log and packet-capture data sets, draft runbooks and knowledge articles, and scaffold Ansible and Python automation
• Maintain Git as the source of truth for network configuration, with golden configuration templates, peer-reviewed changes, and a full version-controlled audit trail
• Operate deployment pipelines for network change, including automated pre-change validation, standards compliance checks, and automated post-deployment verification of routing state, reachability, and interface health
• Implement configuration drift detection and automated remediation, so deployed network configuration provably matches its declared intent
• Codify network standards - naming, addressing, VLAN and VRF conventions, hardening baselines, and device software targets - and gate deployments against them
• Drive deployments from an authoritative source of truth for IP addressing and inventory, rather than from spreadsheets
• Implement zero-touch and templated onboarding so new switches, access points, and site routers reach a compliant baseline without manual console configuration

Network Deployment - Engineering Delivery

• Deploy network configuration items (CIs) including Cisco IOS and NX-OS switches and routers, Juniper devices, Aruba wireless controllers and access points, load balancers, and network appliances, from initial requirement through to validated production handover
• Deliver network deployments at offices, laboratories, manufacturing sites, and on-premises data centres, including physical installation, rack and stack, structured cabling, optics, power and environmental checks, and high-availability pairing
• Deliver hardware refresh, end-of-life replacement, and firmware and network OS upgrade campaigns across Cisco IOS/NX-OS, FortiOS, and Junos platforms, including RMA handling across the device estate
• Execute controlled environment promotion (Dev to Pre-Prod to Production) with documented rollback and recovery plans for every deployment
• Register all deployed CIs in the CMDB with correct class, attributes, relationships, ownership, location, and lifecycle status at point of deployment
• Configure and maintain network discovery and SNMP so network CIs are correctly classified with accurate serial numbers, models, and discovery-source behavior
• Onboard every newly deployed CI into monitoring, telemetry, configuration backup, and patching tooling before production sign-off
• Produce and maintain as-built documentation, network topology diagrams, low-level designs, runbooks, and knowledge articles for all deployed infrastructure

Routing, Switching and Networking Protocols

• Implement and support routing across the estate - BGP and OSPF to a strong standard, static routing, route redistribution, filtering, and path selection
• Design and implement VRF-based segregation and route separation across data center, campus, and WAN environments
• Implement and support switching - VLANs, trunking, spanning tree, link aggregation, vPC, and first-hop redundancy on Cisco IOS and NX-OS platforms
• Implement and support IPSec tunnelling for site-to-site and cloud connectivity, including encryption standards, rekeying, and failover behavior
• Design and implement addressing and subnetting to enterprise standards, maintaining IP address management accuracy as deployments land
• Implement quality of service, multicast, and traffic engineering where application or manufacturing requirements demand it
• Implement network zones, VLANs, and segmentation in line with security architecture and zoning standards, in partnership with the network security team

Data Centre, SDN and SD-WAN

• Deploy and support data center fabrics built on Cisco ACI, using Cisco APIC for policy, tenant, and endpoint group configuration, and VXLAN overlays for tenant connectivity
• Deploy and support leaf-spine data center architectures, including fabric expansion, overlay design, and integration with compute and storage connectivity requirements
• Deploy and support SD-WAN across Palo Alto Prisma SD-WAN (CloudGenix) and FatPipe platforms, including overlay design, transport independence, application-aware routing policy, and failover behavior
• Coordinate circuit delivery with carriers and service providers, managing lead times, handover testing, and acceptance
• Monitor and manage WAN capacity, latency, and cost, recommending upgrades, re-homing, or transport changes

Wireless Networking - WLAN

• Deploy, configure, and support Aruba wireless infrastructure, including controllers, access points, and centralized WLAN management
• Deliver wireless design and validation, including predictive design, site surveys, RF tuning, channel and power planning, and post-deployment validation surveys
• Support wireless authentication integration and guest access in partnership with the network security and identity teams
• Troubleshoot wireless performance, roaming, coverage, and interference issues, including in warehouse, laboratory, and manufacturing environments

Core Network Services and Load Balancing

• Deploy and support core network services - DNS, DHCP, IP address management, NTP, and VPN termination points
• Deploy and support load balancing across F5, Array, and AVI platforms, including virtual servers, pools, health monitors, persistence, and SSL offload
• Automate load balancer configuration and application onboarding through platform APIs, so recurring onboarding work is templated rather than hand-built
• Support Zscaler traffic steering from the network side - tunnel and forwarding configuration, proxy routing, and validation of traffic paths to the cloud security platform
• Support application onboarding from a network perspective - connectivity requirements, name resolution, certificates on network and load balancing platforms, firewall rule requests, and traffic flow validation
• Maintain accurate DNS and IP address records as a deployment output rather than an afterthought

Cloud and Hybrid Networking

• Deploy and support network infrastructure across AWS and Azure - landing zone networking, virtual networks and VPCs, subnetting, routing, peering, and transit architectures, provisioned and maintained through Terraform
• Implement and support hybrid connectivity between cloud, data centers, and sites, including ExpressRoute, Direct Connect, and IPSec VPN, with resilient and tested failover paths
• Implement hybrid and split-horizon DNS resolution across on-premises and cloud estates
• Implement and enforce cloud resource tagging standards for network resources, remediating missing or malformed tags to keep network CIs traceable to their application records
• Support container and Kubernetes network connectivity requirements - ingress, egress, service exposure, and IP address planning - in partnership with platform teams

Operational Support, Incident and Problem Management

• Manage Move to Production processes for deployed CIs, ensuring proper handover to operational support teams and that all required GxP documentation is maintained
• Provide L2/L3 operational support for all deployed network CIs, working closely with managed-service partners
• Participate in an on-call rotation, responding to network incidents outside business hours
• Troubleshoot connectivity, latency, packet loss, jitter, and throughput issues using Wireshark and NetScout, in partnership with engineering teams and service providers, driving down mean time to recovery (MTTR)
• Diagnose faults across the network stack - BGP and OSPF convergence and flapping, spanning tree and loop events, duplex and error counters, MTU and fragmentation, asymmetric routing, IPSec tunnel failures, DHCP scope exhaustion, and DNS resolution failures
• Act as technical escalation during Major Incidents, joining technical bridges and providing hands-on recovery and clear technical status updates
• Contribute to Root Cause Analysis for recurring and high-impact issues, raising Problem records and driving corrective and preventive actions to closure
• Maintain high-quality incident resolution notes and knowledge articles to support first-line resolution and data-quality targets

Change and Release Execution

• Raise, plan, and execute network changes with complete risk assessment, implementation plans, test evidence, and rollback procedures
• Represent network changes at the Change Advisory Board (CAB), providing technical justification, impact analysis, and dependency detail drawn from CMDB service topology
• Actively reduce change-induced incidents through peer review, automated validation, staged rollout, and disciplined post-implementation verification
• Schedule and coordinate deployment windows with application, business, and vendor stakeholders to minimize disruption, respecting manufacturing production schedules and site constraints

Observability, Telemetry and AIOps

• Onboard network CIs into monitoring and observability platforms with meaningful metrics, logs, events, flow data, and synthetic checks
• Implement network telemetry and flow visibility - SNMP, streaming telemetry, and NetFlow or IPFIX - and use NetScout for packet-level and service-level performance visibility, making performance measurable rather than anecdotal
• Define alert thresholds and reduce alert noise so alerts are actionable and correctly routed
• Build operational dashboards providing clear visibility of network health, capacity, circuit performance, wireless quality, and deployment quality
• Support AIOps adoption - anomaly detection, event correlation, service-impact analysis, and predictive insight - including AI-assisted triage of network telemetry using NEXUS and Python tooling

Capacity, Compliance and Resilience

• Monitor and manage network capacity, utilization, and performance; forecast growth and recommend scaling, re-architecture, or refresh
• Deploy and operate all network infrastructure in line with enterprise security architecture, hardening baselines, and least-privilege access principles
• Meet patch compliance and vulnerability remediation SLAs across all supported CIs, including Cisco IOS/NX-OS, FortiOS, and Junos software currency, with evidenced closure
• Maintain configuration backup and rapid device recovery capability, and test restoration rather than assuming it
• Configure and support network high availability, redundancy, and failover, and validate that resilience behaves as designed under test
• Maintain audit-ready evidence of configuration and change history for regulated and GxP-relevant environments

Collaboration, Vendor Coordination and Continuous Improvement

• Partner with Enterprise Architecture, Cyber Security, Cloud Engineering, and Application and Product teams to ensure operational readiness of new platforms and technologies
• Work closely with the network security team on firewall, WAF, DDoS protection, and VPN requirements, implementing segmentation and access requirements to standard and escalating where a requirement is not operable
• Support site and manufacturing stakeholders on network requirements for production, laboratory, and OT environments, respecting validation and availability constraints
• Coordinate technical delivery governance with managed-service partners and vendors, validating the quality of delivered work against standards and SLAs, and ensuring meaningful, timely measurement of vendor support using KPIs

Key Performance Indicators

Deployment

• Deployment success rate and lead time, from request to validated production
• Automation coverage - proportion of network infrastructure and configuration deployed via Terraform, Ansible, Python, and API automation rather than manual device configuration
• First-time-right deployment rate; rework and rollback frequency
• Configuration drift rate and time to remediate detected drift
• Golden configuration and software-target compliance across the Cisco, Juniper, Fortinet, and Aruba estate
• DNS and IP address management record accuracy following deployment
• CI data quality at handover - completeness, correctness, non-orphan, and non-stale on newly deployed CIs
• Monitoring, telemetry, configuration backup, and patching onboarding coverage achieved at production sign-off

Support

• MTTR for supported network CIs; incident backlog and ageing
• Network availability against service commitments, by site and by service tier
• Change success rate and change-induced incident rate
• Recurring incident rate and Problem closure effectiveness
• Network OS currency across Cisco IOS/NX-OS, FortiOS, and Junos; patch compliance and vulnerability remediation within SLA
• End-of-life device count and reduction trend
• Circuit, WAN, and SD-WAN performance against carrier SLAs, including latency, loss, and availability
• Wireless quality metrics - coverage, client experience, and roaming success
• Capacity headroom on core links and forecast accuracy
• Configuration backup coverage and device recovery test pass rate
• CMDB data-quality KPIs for owned CI classes, including discovery coverage and staleness
• Automation and self-healing adoption; measured manual-effort reduction
• Resolution note quality and knowledge-article contribution

About You

Experience

• Substantial hands-on experience deploying and supporting enterprise LAN, WAN, WLAN, data centre, and cloud network infrastructure in large-scale, global, multi-vendor environments
• Demonstrable depth in routing and switching, with working knowledge across wireless, SD-WAN, load balancing, and cloud networking on AWS and Azure
• Practical experience automating network deployment and configuration with Terraform, Ansible, Python, and vendor APIs
• Experience supporting manufacturing, laboratory, or OT network environments is an advantage
• Experience in a regulated industry - pharmaceutical, life sciences, or comparable - is an advantage

Technical Skills - Networking Protocols and Routing

• Strong TCP/IP fundamentals, subnetting, and protocol-level understanding
• BGP and OSPF to a strong standard, including route filtering, redistribution, and path selection
• VRF design and implementation for route separation and multi-tenancy
• IPSec for site-to-site and cloud tunnelling, including encryption standards and failover
• VXLAN overlays and their integration with data centre fabric design
• Switching - VLANs, trunking, spanning tree, link aggregation, vPC, and first-hop redundancy
• Quality of service, multicast, and traffic engineering

Technical Skills - Data Centre, SDN and SD-WAN

• Cisco ACI fabric design, deployment, and operation, with hands-on Cisco APIC policy configuration
• Leaf-spine data centre architecture and VXLAN overlay operation
• SD-WAN deployment and support on Palo Alto Prisma SD-WAN (CloudGenix) and FatPipe
• WAN transport - MPLS, internet, broadband and cellular backup, and carrier engagement

Technical Skills - WLAN and Campus

• Aruba wireless - controllers, access points, and centralized WLAN management
• RF design, site survey tooling, channel and power planning, and roaming and performance troubleshooting
• Campus LAN design across access, distribution, and core layers on Cisco IOS and NX-OS platforms

Technical Skills - Load Balancing and Core Services

• Load balancing on F5, Array, and AVI platforms - virtual servers, pools, monitors, persistence, and SSL offload
• DNS, DHCP, IP address management, and NTP at enterprise scale
• Zscaler traffic forwarding and steering from a network perspective
• Certificates and TLS as applied to network and load balancing platforms

Technical Skills - Cloud and Hybrid Networking

• Networking on AWS and Azure - virtual networks and VPCs, subnetting, route tables, peering, transit gateway or virtual WAN, and cloud load balancers
• Terraform for cloud network provisioning - module design, remote state, plan and apply workflow, and drift detection
• Hybrid connectivity - ExpressRoute, Direct Connect, and IPSec VPN, with resilient design
• Hybrid and split-horizon DNS resolution
• Container and Kubernetes networking concepts - ingress, egress, and IP planning
• Cloud tagging and governance standards

Technical Skills - Network Security Interface

• Working knowledge of firewalls - Cisco ASA and FTD, Fortinet FortiGate, and Juniper SRX - sufficient to implement to standard and troubleshoot policy-related faults
• Awareness of Web Application Firewall and DDoS protection services and how they affect traffic flow
• Working familiarity with AlgoSec for raising and tracking firewall rule requests and understanding policy impact on planned network changes
• Ability to interpret firewall and security platform logs, including FortiAnalyzer, when isolating whether a fault is network or policy related
• VPN connectivity and remote access from a network perspective
• Understanding of how inspection points, proxies, NAT, and Zscaler forwarding affect traffic flow and application behaviour
• Deep firewall policy administration sits with the network security team; this role partners with them rather than owning that scope

Automation, Tooling and AI

• Terraform - infrastructure-as-code provisioning of AWS and Azure network resources, including module design, remote state, and plan review as a change gate
• Ansible - reusable roles, templates, and inventory management for multi-vendor network configuration
• Python - scripting, API consumption, and automated pre- and post-change validation
• Selenium - automation of vendor web consoles and portals that expose no usable API
• NEXUS as an AI agent for configuration review, log and capture triage, documentation drafting, and automation scaffolding
• Platform and controller APIs - Cisco APIC, Junos Space, Prisma SD-WAN, FatPipe, and F5, Array, and AVI
• Version control and change pipelines - Git-based workflow for network configuration
• Operating systems - Cisco IOS and NX-OS, FortiOS, and working command-line competence on Linux and Windows

Troubleshooting and Diagnostics

• Wireshark - packet capture and protocol-level analysis, including SPAN and mirror captures
• NetScout - packet-level and service-level performance monitoring and fault isolation
• Flow and telemetry analysis - NetFlow or IPFIX, SNMP, and streaming telemetry
• Structured fault isolation across physical, data link, network, and application layers

ITSM, CMDB and Observability

• ServiceNow - Incident, Problem, Change, Request, and CMDB/CSDM; Discovery and Service Mapping experience strongly preferred
• Strong working knowledge of ITIL/ITSM practices, particularly Incident, Problem, and Change Management
• Monitoring and observability platforms covering metrics, logs, flow data, and alert design
• Exposure to AIOps and intelligent-operations use cases

Behavioural Competencies

• Strong ownership mindset - accountable for what you deploy, through to production stability
• Calm, structured, and effective under pressure during major incidents, including when the network is the prime suspect
• Rigorous and detail-oriented, with genuine discipline around change control and documentation
• Strong analytical and problem-solving skills, able to diagnose across domain boundaries and prove where a fault is not
• Clear communicator, able to explain technical issues in business terms
• Collaborative and customer-focused, comfortable working across teams, vendors, sites, and time zones
• Willingness to travel to sites for deployment and fault resolution where required
• Automation-first instinct and a continuous-improvement mindset

Preferred Certifications

• Routing and switching - Cisco CCNP Enterprise or CCIE Enterprise Infrastructure; Juniper JNCIA or JNCIP
• Data centre and SDN - Cisco CCNP Data Center or Cisco ACI specialisation
• Wireless - Aruba ACMA or ACMP, or CWNA
• Cloud networking - AWS Advanced Networking Specialty or Microsoft AZ-700 (Azure Network Engineer Associate)
• Security and SD-WAN - Fortinet NSE, or Palo Alto Prisma SD-WAN certification
• Load balancing - F5 certification (101, 201, or 301)
• Automation - HashiCorp Terraform Associate, Cisco DevNet Associate, or Red Hat Ansible Automation
• ITSM - ITIL 4 Foundation or Managing Professional; ServiceNow CSA, CAD, or Discovery/CMDB certification
• Agile - Certified Scrum or Agile certification

Languages

• English required; additional languages an advantage

Pursue progress, discover extraordinary

Better is out there. Better medications, better outcomes, better science. But progress doesn’t happen without people - people from different backgrounds, in different locations, doing different roles, all united by one thing: a desire to make miracles happen. So, let’s be those people.

At Sanofi, we provide equal opportunities to all regardless of race, colour, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, ability or gender identity.

Watch our ALL IN video and check out our Diversity Equity and Inclusion actions at sanofi.com!