TEKsystems
Security Design Engineer
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Security Design Engineer - 6 Month Contract - INSIDE IR35 - Sheffield, Manchester, Birmingham - No Sponsorship Available
Job Description
The Design Engineer is responsible for the Architecture of Network Security components as related to zero trust in a platform transformation programme. The Design Engineer must act as a bridge between traditional network security controls and modern identity-based security provided by a service mesh. This role must assess how existing network security controls interact with service mesh capabilities and produce E2E solution designs, standards, patterns, and related artefacts. This is part of a larger platform initiative and requires extensive collaboration across the organisation. Responsibility for reviewing, designing, and collaborating with numerous business units is also key to the position. This is a multi-faceted role involving numerous areas of expertise and stakeholders across the enterprise.
Design Engineers must be comfortable presenting and sharing solutions, standards, patterns at design authorities, and with senior leadership & stakeholders. Additionally, the Security Design Engineer will provide technical thought leadership and direction to their aligned projects and operate as a Subject Matter Expert, providing consultancy.
Principal Requirements
Expertise:
- Application design from platform selection, to deployment with significant experience designing to meet scale, demand, and in a secure fashion (e.g., DevSecOps)
- Knowledge and practical experience of implementing modern application architecture practices, from CSP-native, to Hybrid designs, EDA along with microservices and serverless
- Deep practical and considerable experience in Cyber Security: Threats and modelling, Risks and assessments, Attack vectors, vulnerabilities, CEH, and red/purple teaming
- Assess how existing network security controls apply within service mesh (e.g., Firewalls, NIPS/NIDS, WAF, Proxies, DDoS, Segmentation)
- Significant practical experience and proven technical depth across network security:
- Firewall design and implementation, next-gen capabilities
- NIPS/NIDS design and implementation, automation, workflow, and framework
- WAF design and deployment within internally and externally presented apps
- Forward Proxy design and implementation across numerous use-cases
- Reverse Proxy platform design and deployment protecting apps, APIs
- Denial of Service design and implementation from volumetric to application
- Network Segmentation design securing application components from threat susceptibility
- Network visibility and traffic monitoring
- Large scale distributed systems
- Modelling and documentation of communication flows
- Automation and workflow-driven protections
- Defence in depth along with related capabilities: TLS, PKI, and identity-based controls
- Practical working technical knowledge of Service Mesh:
- experience with one or more vendors (e.g., Istio, Kong)
- Sidecar and mTLS implementation
- Workload identities in conjunction with gateways
- Identity and Access Management using modern authNZ (e.g., OIDC, JWT, etc.)
- Logging & Monitoring for security, optimisation, delivery of intelligence and insights
- Management access and isolation including recording of changes
- Analysis of rules, gaps, traffic seen, and proactively updating programmatically
- Anomalous traffic flows and inspection to identify
- Ensuring regulations and compliance can be attested to through visibility
- External capabilities and integrations that can provide intel and visibility of security
- experience in large-scale global Financial Services and Regulatory requirements, audits
- Maintaining a data-driven, evidence-based approach to decision making
- Demonstrable proven experience authoring Standards, Patterns, Designs utilising industry standard methodologies and references (e.g., NIST, SANS, ISO, ITU, ISF, etc.)
- Documentation of above areas including but not limited to: Standards, Patterns, Strategies, Roadmaps, and recommendation papers, positioned at senior leadership and engineers
- Broad background across information technology with the ability to communicate clearly with non-security technical SMEs at a comfortable level
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Qualifications & Certifications:
- Bachelors or Masters degree in Cybersecurity, Computer Science, Software Engineering, or related scientific or mathematic field
- SABSA, TOGAF certification or related industry-recognised certifications
- Software architecture qualifications (e.g., CPSA), Application security (e.g., CEH or similar)
- CSP security certification (e.g., AWS, Azure, GCP)
Platform & Technology:
- Working practical knowledge of legacy and modern networking infrastructure
- experience with Akamai, F5, Azure, AWS, NginX, Checkpoint, Cisco, and related platforms
- BizzDesign, Archi, or generic UML visualisation experience for high-level designs
- Working proficiency in Jira, Confluence for project & tasks management, documentation
Principal Accountabilities and Responsibilities
Architecture & Design:
- Extensive collaboration with primary stakeholders: Enterprise and Platform Architects, Solution Architects, Data Analysts & Engineers, Cyber colleagues (Capability Leads, Control owners)
- Ensuring Standards and Patterns are drawn up in collaboration with stakeholders and approved through relevant governance
- Documenting, raising, and escalating technical debt, risks, and issues along with identifying security gaps and challenges and documenting formally
- Providing security assurance, advice, and guidance to Engineering, Project Managers, senior stakeholders in delivering strategic outcomes for business needs
- Clear understanding of both the motivations of the business and technical security
Governance:
- Self-motivated with ability to present artefacts to design authorities and articulate deep technical concepts to a broad range of stakeholders in both large forums and smaller deep-dive sessions
- Ownership and driving Standards, Patterns, and Designs from authoring, collaboration with stakeholders through to final approval
- Ensure all architecture artefacts undergo appropriate peer-review prior to seeking approval
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Risk and Dependency Management:
- Effectively manages and formally escalates both technical and project risks or issues
- Ability to map design decisions to result in technical risks & issues and articulate the cause and rationale which leads to any negatively impacting change
Leadership & Teamwork:
- Communicates clearly, openly, and creates visible presence in all calls to ensure security is centre to requirements (e.g., Security by design)
- Lead others by example, creating an environment that inspires security deliverables
- Builds effective social networks both internally and externally with key stakeholders, communicating consistently and continuously
Location
Manchester, UK
Trading as TEKsystems. Allegis Group Limited, Maxis 2, Western Road, Bracknell, RG12 1RT, United Kingdom. No. 2876353. Allegis Group Limited operates as an Employment Business and Employment Agency as set out in the Conduct of Employment Agencies and Employment Businesses Regulations 2003. TEKsystems is a company within the Allegis Group network of companies (collectively referred to as "Allegis Group"). Aerotek, Aston Carter, EASi, Talentis Solutions, TEKsystems, Stamford Consultants, and The Stamford Group are Allegis Group brands. If you apply, your personal data will be processed as described in the Allegis Group Online Privacy Notice available at https://www.allegisgroup.com/en-gb/privacy-notices.
To access our Online Privacy Notice, which explains what information we may collect, use, share, and store about you, and describes your rights and choices about this, please go to https://www.allegisgroup.com/en-gb/privacy-notices.
We are part of a global network of companies and as a result, the personal data you provide will be shared within Allegis Group and transferred and processed outside the UK, Switzerland, and European Economic Area subject to the protections described in the Allegis Group Online Privacy Notice. We store personal data in the UK, EEA, Switzerland, and the USA. If you would like to exercise your privacy rights, please visit the "Contacting Us" section of our Online Privacy Notice at https://www.allegisgroup.com/en-gb/privacy-notices for details on how to contact us. To protect your privacy and security, we may take steps to verify your identity, such as a password and user ID if there is an account associated with your request, or identifying information such as your address or date of birth, before proceeding with your request. If you are resident in the UK, EEA, or Switzerland, we will process any access request you make in accordance with our commitments under the UK Data Protection Act, EU-U.S. Privacy Shield, or the Swiss-U.S. Privacy Shield.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills