Network and Security Engineer

Project overview

We are looking for one of our clients in the industrial sector in an international context for a Network and Security Engineer in defense.

We are looking for a Network Security Engineer to strengthen our Cybersecurity team, focusing on network traffic management.

Context of the position

Reporting to the Cybersecurity team, the Network Security Engineer is responsible for managing the traffic flowing through the company's network. They analyze traffic matrices, challenge requests for opening or modifying infrastructure and business traffic, and decide on their authorization or refusal based on cyber best practices and internal network security policy.

Main missions

Required technical skills

Behavioral skills

Profile sought

• Analysis of traffic matrices: study each traffic request (source, destination, port, protocol, direction, business justification) and verify its compliance with the network architecture, application HLDs and LLDs, and current security rules.
• Authorization/refusal decision: validate or refuse traffic according to the principle of least privilege, network segmentation, risk analysis, and internal security policy.
• Management of hybrid multisite/datacenter/cloud traffic: analyze inter-site traffic, between datacenters (North-South and East-West), and towards Azure cloud (VNet, NSG, Azure Firewall / virtual FortiGate, VPN, ExpressRoute), and ensure consistency of rules between on-premise and cloud.
• Traceability and documentation: record each decision (justification, validity period, requester, review date) in the traffic management tools.
• Periodic review and cleanup: regularly audit existing rules, identify obsolete, unused, or oversized traffic, and propose their removal.
• Contribution to network security policy: participate in the drafting, updating, and dissemination of segmentation, filtering, and secure architecture standards (zero trust, DMZ, micro-segmentation).
• Audit support: prepare and support internal/external audits and compliance checks (ISO 27001, ANSSI, PCI-DSS depending on context).
• Technical watch: follow market evolutions in network threats, vulnerabilities, and best practices.
• (Additionally) Firewall log optimization: define and optimize firewall logging policy (rules to log, log levels, volume, filtering of logs sent to SIEM / FortiAnalyzer) to improve detection relevance while controlling storage and license costs.
• Solid mastery of network protocols.
• Operational experience with firewalls (Fortinet).
• Knowledge of secure network architectures: segmentation, DMZ, zero trust, micro-segmentation.
• Experience with multisite and datacenter environments (SD-WAN, site-to-site VPN, interconnections, North-South / East-West traffic).
• Knowledge of Microsoft Azure network and security (VNet, peering, NSG, Azure Firewall, FortiGate deployment in Azure environment).
• Mastery of centralized firewall administration (FortiManager or equivalent) and logging/reporting tools (FortiAnalyzer, SIEM, Syslog).
• Ability to analyze and optimize the volume and quality of logs generated by firewalls (event selection, retention, correlation).
• Experience with traffic matrix management / change management tools (Tufin, AlgoSec, or equivalent) is appreciated.
• Knowledge of standards and repositories: ISO 27001, ANSSI IT hygiene guides, NIST.
• Basic scripting knowledge (Python, Bash) for control automation is a plus.
• Knowledge of IDS/IPS solutions and network supervision (SIEM) is appreciated.
• Rigor, analytical thinking, and attention to detail.
• Ability to clearly document and justify decisions.
• Sense of responsibility regarding the company's security challenges.
• Good interpersonal skills for dialogue with infrastructure, application, and business teams.
• Autonomy and ability to manage priorities in a context of multiple requests.
• Master's degree (engineering school or university) in IT security, networks, or telecommunications.
• 2 to 5 years of experience in a similar role (network engineer, network security, or SOC), level adjustable according to the target position.
• Appreciated certifications: CCNA/CCNP Security, Fortinet NSE, Microsoft AZ-700 (Azure Network Engineer)

Project details

• Start: flexible
• Duration: 3 mois (renouvelables)
• Location: 92800 la defense, FR
• Languages: French