{"id":2465317,"url":"https://alion.io/job/sanofi-network-security-engineer-deployment-and-support","title":"Network Security Engineer – Deployment and Support","company":{"id":146,"name":"Sanofi","domain":"sanofi.com","url":"https://alion.io/company/sanofi","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":97,"open_postings":103,"ghost_share":0,"stale_share":0.301,"repost_share":0.029,"time_to_fill_p50_days":14,"computed_at":"2026-10-14T06:34:16Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Hyderabad, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":24000,"max_usd":57000,"period":"year","method":"role_country_seniority_unknown","sample_n":39},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agile","optional":false},{"name":"AI Agents","optional":false},{"name":"AIOps","optional":false},{"name":"Anomaly Detection","optional":false},{"name":"Ansible","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"BGP","optional":false},{"name":"DHCP","optional":false},{"name":"DNS","optional":false},{"name":"FortiGate","optional":false},{"name":"Git","optional":false},{"name":"ITIL","optional":false},{"name":"ITSM","optional":false},{"name":"Least Privilege","optional":false},{"name":"OSPF","optional":false},{"name":"PKI","optional":false},{"name":"Python","optional":false},{"name":"Red Hat","optional":false},{"name":"Scrum","optional":false},{"name":"Selenium","optional":false},{"name":"Self-Healing","optional":false},{"name":"ServiceNow","optional":false},{"name":"SIEM","optional":false},{"name":"SLI/SLO/SLA","optional":false},{"name":"TCP/IP","optional":false},{"name":"Terraform","optional":false},{"name":"VPN","optional":false},{"name":"Windows","optional":false},{"name":"Wireshark","optional":false},{"name":"Zero Trust","optional":false},{"name":"Zscaler","optional":false}],"status":"live","first_seen_at":"2026-10-13T18:24:54Z","employer_posted_date":"2026-10-13","last_verified_at":"2026-10-14T03:34:52Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"About the Job\nAs 'Network Security Engineer - Deployment and Support' within our Digital Technology Service Quality team, you will build, deploy, and support the network security estate that protects Sanofi's enterprise - firewalls across Cisco ASA and FTD, Fortinet FortiGate, and Juniper SRX, Web Application Firewalls, DDoS protection, VPNs, and the Zscaler cloud security platform. You will deploy security infrastructure and policy as code using Terraform, Ansible, and Python wherever the platform allows, and apply the same engineering rigour where it does not. You will own what you deploy - from policy definition and automated pre-change validation through to day-two operations, rule lifecycle hygiene, and incident response - ensuring our network security posture remains accurate, auditable, and resilient. Ready to get started?\nOur Team\nDigital Technology - Service Quality is at the heart of Sanofi's digital transformation. We deliver secure, resilient, and scalable infrastructure services that power business-critical applications and enable thousands of users across the enterprise. Our network security engineering team sits at the boundary of every service we run - enforcing segmentation, controlling access, and giving our security operations colleagues the visibility they need. Our team combines modern cloud platforms, automation-first engineering, and service excellence to support Sanofi's mission of chasing the miracles of science.\nAbout Sanofi\nWe're an R&D-driven, AI-powered biopharma company committed to improving people's lives and delivering compelling growth. Our deep understanding of the immune system - and innovative pipeline - enables us to invent medicines and vaccines that treat and protect millions of people around the world. Together, we chase the miracles of science to improve people's lives.\nMain Responsibilities\nNetwork Security Deployment - Infrastructure and Policy as Code\nDeploy cloud network security infrastructure as code using Terraform, provisioning security groups and network security groups, cloud-native firewall and WAF policy, route tables, private connectivity, and inspection architectures across AWS and Azure, with reusable modules, remote state management, and plan review built into the change process\nDeploy and maintain firewall and network security configuration as code using Ansible, building reusable roles and templates for Cisco ASA and FTD, Fortinet FortiOS, and Juniper SRX so that every change is repeatable, version-controlled, and auditable\nAutomate security provisioning and operational tasks in Python, consuming platform APIs - Junos Space for SRX estate management, Cisco APIC for ACI contract and microsegmentation policy, FortiGate and FortiAnalyzer APIs, Zscaler APIs, and F5, Array, and AVI load balancer and WAF APIs\nAutomate vendor web consoles and portals that expose no usable API using Selenium, so that licensing, reporting, and legacy management interfaces do not force manual work\nUse Gemini CLI as an AI agent within the engineering workflow to accelerate policy review, triage large firewall log and packet-capture data sets, summarise rule-base findings, draft runbooks and knowledge articles, and scaffold Ansible and Python automation\nMaintain Git as the source of truth for network security configuration, with golden configuration templates, peer-reviewed changes, and a full version-controlled audit trail of every policy change\nOperate deployment pipelines for network security change, including automated pre-change validation, policy risk and compliance checks using AlgoSec, and automated post-deployment verification of traffic flow and policy hit behaviour\nImplement configuration drift detection and automated remediation, so deployed security policy provably matches its declared intent\nCodify security baselines and standards - hardening, zoning, naming, and device software targets - and gate deployments against them\nIntegrate the firewall rule request lifecycle with ServiceNow, so approved requests flow into validated, automated deployment rather than manual console work\nNetwork Security Deployment - Engineering Delivery\nBuild and deploy network security configuration items (CIs) - firewalls, VPN concentrators, WAF and load balancer platforms, and DDoS protection services - from initial requirement through to validated production handover\nDeliver deployments to enterprise sites, manufacturing sites, and on-premises data centres, including physical installation, cabling, high-availability pairing, licensing, and firmware qualification where automation is not available\nDeliver hardware refresh, end-of-life replacement, and software upgrade campaigns across Cisco ASA/FTD, FortiOS, and Junos SRX platforms\nExecute controlled environment promotion (Dev to Pre-Prod to Production) with documented rollback and recovery plans for every change\nRegister all deployed network security CIs in the CMDB with correct class, attributes, relationships, ownership, location, and lifecycle status at point of deployment\nConfigure and maintain network discovery and SNMP so security CIs are correctly classified with accurate serial numbers, models, and discovery-source behaviour\nOnboard every newly deployed CI into monitoring, alerting, log forwarding, configuration backup, patching, and vulnerability tooling before production sign-off\nProduce and maintain as-built documentation, network security diagrams, runbooks, and knowledge articles for all deployed infrastructure\nFirewall and Policy Engineering\nDeploy, configure, and support enterprise firewalls across Cisco ASA and FTD, Fortinet FortiGate running FortiOS, and Juniper SRX platforms\nDesign and implement firewall policy to least-privilege principles, using application-aware, user-aware, and identity-based rules rather than broad address-based permits\nOwn the full firewall rule lifecycle - request, validation, implementation, recertification, and decommissioning - driving down rule count, shadowed and redundant rules, overly permissive any-any rules, and unused objects\nOperate AlgoSec for policy analysis, change risk assessment, rule-base optimisation, compliance reporting, and evidencing rule recertification to auditors\nUse FortiAnalyzer for centralised Fortinet logging, reporting, and forensic review of policy and threat events\nImplement and tune threat prevention capabilities - IPS, anti-malware, URL filtering, and TLS inspection - balancing security efficacy against application impact\nManage firewall estate configuration centrally, using Junos Space for Juniper SRX and native management platforms for Cisco and Fortinet devices\nSegmentation, Zoning and Microsegmentation\nImplement and maintain network zones, VLANs, VRF separation, and segmentation in line with security architecture and enterprise zoning standards\nDeliver data centre microsegmentation using Cisco ACI contracts and endpoint group policy configured through Cisco APIC\nImplement east-west controls across data centre, cloud, and OT or manufacturing environments, working to a zero-trust target architecture\nSegregate and protect manufacturing, laboratory, and OT networks, respecting the availability and validation constraints of regulated production environments\nValidate segmentation effectiveness through testing and traffic analysis rather than assuming policy intent equals enforced reality\nVPN, Secure Access and Cloud Security Platform\nDeploy and support remote access services - SSL VPN and IPSec VPN, and identity-integrated access with multi-factor authentication - at enterprise scale\nDeploy and support site-to-site IPSec connectivity, including tunnel design, encryption standards, rekeying, and failover behaviour\nDeploy and support the Zscaler cloud security platform, including secure web gateway and private access policy, traffic forwarding and steering, SSL inspection, and user and location configuration\nSupport SD-WAN security posture across Palo Alto Prisma SD-WAN (CloudGenix) and FatPipe platforms, including secure overlay design and policy enforcement at the edge\nSupport secure connectivity for cloud workloads on AWS and Azure, including security groups and network security groups, cloud-native firewalling, private connectivity, and inspection architectures, provisioned and maintained through Terraform\nWeb Application Firewall, Load Balancing and DDoS Protection\nDeploy and support Web Application Firewall capability on F5, Array, and AVI platforms, including policy creation, tuning, and false-positive management\nDeploy and support load balancing security configuration - virtual servers, pools, health monitors, SSL offload, and certificate lifecycle\nImplement and support DDoS protection services at the internet edge, including mitigation policy, thresholds, and activation runbooks\nSupport application onboarding from a security perspective - traffic flow validation, rule requirements, name resolution, and certificate provisioning\nManage certificates, keys, and secrets used by network security platforms through enterprise PKI and key vault services, ensuring timely renewal and no untracked expiry\nOperational Support, Incident and Problem Management\nManage Move to Production processes for deployed CIs, ensuring proper handover to operational support teams and that all required GxP documentation is maintained\nProvide L2/L3 operational support for all deployed network security CIs, working closely with managed-service partners\nParticipate in an on-call rotation, responding to network security incidents outside business hours\nDiagnose and resolve incidents where security policy is a suspected cause - blocked applications, asymmetric routing through inspection points, IPSec and SSL VPN failures, certificate and TLS errors, and Zscaler forwarding faults - using Wireshark and NetScout for packet-level evidence\nDrive down mean time to recovery (MTTR) through structured troubleshooting, runbooks, and automation\nAct as technical escalation during Major Incidents, joining technical bridges and providing hands-on recovery and clear technical status updates\nSupport the Security Operations Centre and incident response teams during active security events, delivering rapid containment actions such as blocks, isolation, and emergency policy changes under controlled process\nContribute to Root Cause Analysis for recurring and high-impact issues, raising Problem records and driving corrective and preventive actions to closure\nMaintain high-quality incident resolution notes and knowledge articles to support first-line resolution and data-quality targets\nChange and Release Execution\nRaise, plan, and execute network security changes with complete risk assessment, implementation plans, test evidence, and rollback procedures\nRepresent network security changes at the Change Advisory Board (CAB), providing technical justification, impact analysis, and dependency detail drawn from CMDB service topology\nActively reduce change-induced incidents through peer review, automated validation, staged rollout, and disciplined post-implementation verification\nSchedule and coordinate deployment windows with application, business, and vendor stakeholders to minimise disruption\nOperate emergency change process for urgent security containment without compromising traceability or approval integrity\nObservability, Logging and AIOps\nOnboard network security CIs into monitoring and observability platforms with meaningful metrics, logs, events, and synthetic checks\nEnsure complete and reliable log forwarding from all security platforms to SIEM, using FortiAnalyzer and native platform logging, and validate parsing, field mapping, and coverage so detection content is not blind\nUse NetScout for service-level and packet-level visibility across inspection points, proving whether a security control is implicated in a performance problem\nDefine alert thresholds and reduce alert noise so alerts are actionable and correctly routed\nBuild operational dashboards providing clear visi...","description_format":"text","description_chars":23499,"description_truncated":true,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Network Security","Vaccines","Rare Disease Therapeutics","Immunology & Inflammation Therapeutics"],"lifecycle":[{"event":"open","at":"2026-10-13T18:24:54Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":14,"reasons":["conf:2","win:early","comp:brand"],"computed_at":"2026-10-14T06:34:16Z"},"pay":null,"html_url":"https://alion.io/job/sanofi-network-security-engineer-deployment-and-support","json_url":"https://alion.io/job/sanofi-network-security-engineer-deployment-and-support.json","meta":{"generated_at":"2026-10-14T07:54:33Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9069,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":146},"rest":"https://alion.io/mcp/rest/get_company?id=146"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsanofi-network-security-engineer-deployment-and-support"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsanofi-network-security-engineer-deployment-and-support"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsanofi-network-security-engineer-deployment-and-support"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sanofi-network-security-engineer-deployment-and-support\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsanofi-network-security-engineer-deployment-and-support"}]}