You will be taken to Sanofi’s own careers page to apply. Job ID R2873770.
Job description
About the Job
As 'Network Security Engineer – Deployment and Support' within our Digital Technology Service Quality team, you will build, deploy, and support the network security estate that protects Sanofi's enterprise — firewalls across Cisco ASA and FTD, Fortinet FortiGate, and Juniper SRX, Web Application Firewalls, DDoS protection, VPNs, and the Zscaler cloud security platform. You will deploy security infrastructure and policy as code using Terraform, Ansible, and Python wherever the platform allows, and apply the same engineering rigour where it does not. You will own what you deploy — from policy definition and automated pre-change validation through to day-two operations, rule lifecycle hygiene, and incident response — ensuring our network security posture remains accurate, auditable, and resilient. Ready to get started?
Our Team
Digital Technology – Service Quality is at the heart of Sanofi's digital transformation. We deliver secure, resilient, and scalable infrastructure services that power business-critical applications and enable thousands of users across the enterprise. Our network security engineering team sits at the boundary of every service we run — enforcing segmentation, controlling access, and giving our security operations colleagues the visibility they need. Our team combines modern cloud platforms, automation-first engineering, and service excellence to support Sanofi's mission of chasing the miracles of science.
Explore opportunities
Find Your Next MNC Job
Stop checking thousands of career pages. Find MNC jobs in one place.
Find. Explore. Apply. Discover jobs from leading companies in one place and apply directly on their official career websites.
01
Discover MNC Jobs
Browse fresh opportunities from 1000+ top companies in one place.
02
Open the Opportunity
Select the job that matches your skills, location and experience.
03
Apply on Official Website
Apply directly through the company’s official career page.
About Sanofi
We're an R&D-driven, AI-powered biopharma company committed to improving people's lives and delivering compelling growth. Our deep understanding of the immune system – and innovative pipeline – enables us to invent medicines and vaccines that treat and protect millions of people around the world. Together, we chase the miracles of science to improve people's lives.
Main Responsibilities
Network Security Deployment – Infrastructure and Policy as Code
Deploy cloud network security infrastructure as code using Terraform, provisioning security groups and network security groups, cloud-native firewall and WAF policy, route tables, private connectivity, and inspection architectures across AWS and Azure, with reusable modules, remote state management, and plan review built into the change process
Deploy and maintain firewall and network security configuration as code using Ansible, building reusable roles and templates for Cisco ASA and FTD, Fortinet FortiOS, and Juniper SRX so that every change is repeatable, version-controlled, and auditable
Automate security provisioning and operational tasks in Python, consuming platform APIs — Junos Space for SRX estate management, Cisco APIC for ACI contract and microsegmentation policy, FortiGate and FortiAnalyzer APIs, Zscaler APIs, and F5, Array, and AVI load balancer and WAF APIs
Automate vendor web consoles and portals that expose no usable API using Selenium, so that licensing, reporting, and legacy management interfaces do not force manual work
Use Gemini CLI as an AI agent within the engineering workflow to accelerate policy review, triage large firewall log and packet-capture data sets, summarise rule-base findings, draft runbooks and knowledge articles, and scaffold Ansible and Python automation
Maintain Git as the source of truth for network security configuration, with golden configuration templates, peer-reviewed changes, and a full version-controlled audit trail of every policy change
Operate deployment pipelines for network security change, including automated pre-change validation, policy risk and compliance checks using AlgoSec, and automated post-deployment verification of traffic flow and policy hit behaviour
Implement configuration drift detection and automated remediation, so deployed security policy provably matches its declared intent
Codify security baselines and standards — hardening, zoning, naming, and device software targets — and gate deployments against them
Integrate the firewall rule request lifecycle with ServiceNow, so approved requests flow into validated, automated deployment rather than manual console work
Build and deploy network security configuration items (CIs) — firewalls, VPN concentrators, WAF and load balancer platforms, and DDoS protection services — from initial requirement through to validated production handover
Deliver deployments to enterprise sites, manufacturing sites, and on-premises data centres, including physical installation, cabling, high-availability pairing, licensing, and firmware qualification where automation is not available
Deliver hardware refresh, end-of-life replacement, and software upgrade campaigns across Cisco ASA/FTD, FortiOS, and Junos SRX platforms
Execute controlled environment promotion (Dev to Pre-Prod to Production) with documented rollback and recovery plans for every change
Register all deployed network security CIs in the CMDB with correct class, attributes, relationships, ownership, location, and lifecycle status at point of deployment
Configure and maintain network discovery and SNMP so security CIs are correctly classified with accurate serial numbers, models, and discovery-source behaviour
Onboard every newly deployed CI into monitoring, alerting, log forwarding, configuration backup, patching, and vulnerability tooling before production sign-off
Produce and maintain as-built documentation, network security diagrams, runbooks, and knowledge articles for all deployed infrastructure
Firewall and Policy Engineering
Deploy, configure, and support enterprise firewalls across Cisco ASA and FTD, Fortinet FortiGate running FortiOS, and Juniper SRX platforms
Design and implement firewall policy to least-privilege principles, using application-aware, user-aware, and identity-based rules rather than broad address-based permits
Own the full firewall rule lifecycle — request, validation, implementation, recertification, and decommissioning — driving down rule count, shadowed and redundant rules, overly permissive any-any rules, and unused objects
Operate AlgoSec for policy analysis, change risk assessment, rule-base optimisation, compliance reporting, and evidencing rule recertification to auditors
Use FortiAnalyzer for centralised Fortinet logging, reporting, and forensic review of policy and threat events
Implement and tune threat prevention capabilities — IPS, anti-malware, URL filtering, and TLS inspection — balancing security efficacy against application impact
Manage firewall estate configuration centrally, using Junos Space for Juniper SRX and native management platforms for Cisco and Fortinet devices
Segmentation, Zoning and Microsegmentation
Implement and maintain network zones, VLANs, VRF separation, and segmentation in line with security architecture and enterprise zoning standards
Deliver data centre microsegmentation using Cisco ACI contracts and endpoint group policy configured through Cisco APIC
Implement east-west controls across data centre, cloud, and OT or manufacturing environments, working to a zero-trust target architecture
Segregate and protect manufacturing, laboratory, and OT networks, respecting the availability and validation constraints of regulated production environments
Validate segmentation effectiveness through testing and traffic analysis rather than assuming policy intent equals enforced reality
VPN, Secure Access and Cloud Security Platform
Deploy and support remote access services — SSL VPN and IPSec VPN, and identity-integrated access with multi-factor authentication — at enterprise scale
Deploy and support site-to-site IPSec connectivity, including tunnel design, encryption standards, rekeying, and failover behaviour
Deploy and support the Zscaler cloud security platform, including secure web gateway and private access policy, traffic forwarding and steering, SSL inspection, and user and location configuration
Support SD-WAN security posture across Palo Alto Prisma SD-WAN (CloudGenix) and FatPipe platforms, including secure overlay design and policy enforcement at the edge
Support secure connectivity for cloud workloads on AWS and Azure, including security groups and network security groups, cloud-native firewalling, private connectivity, and inspection architectures, provisioned and maintained through Terraform
Web Application Firewall, Load Balancing and DDoS Protection
Deploy and support Web Application Firewall capability on F5, Array, and AVI platforms, including policy creation, tuning, and false-positive management
Deploy and support load balancing security configuration — virtual servers, pools, health monitors, SSL offload, and certificate lifecycle
Implement and support DDoS protection services at the internet edge, including mitigation policy, thresholds, and activation runbooks
Support application onboarding from a security perspective — traffic flow validation, rule requirements, name resolution, and certificate provisioning
Manage certificates, keys, and secrets used by network security platforms through enterprise PKI and key vault services, ensuring timely renewal and no untracked expiry
Operational Support, Incident and Problem Management
Manage Move to Production processes for deployed CIs, ensuring proper handover to operational support teams and that all required GxP documentation is maintained
Provide L2/L3 operational support for all deployed network security CIs, working closely with managed-service partners
Participate in an on-call rotation, responding to network security incidents outside business hours
Diagnose and resolve incidents where security policy is a suspected cause — blocked applications, asymmetric routing through inspection points, IPSec and SSL VPN failures, certificate and TLS errors, and Zscaler forwarding faults — using Wireshark and NetScout for packet-level evidence
Drive down mean time to recovery (MTTR) through structured troubleshooting, runbooks, and automation
Act as technical escalation during Major Incidents, joining technical bridges and providing hands-on recovery and clear technical status updates
Support the Security Operations Centre and incident response teams during active security events, delivering rapid containment actions such as blocks, isolation, and emergency policy changes under controlled process
Contribute to Root Cause Analysis for recurring and high-impact issues, raising Problem records and driving corrective and preventive actions to closure
Maintain high-quality incident resolution notes and knowledge articles to support first-line resolution and data-quality targets
Change and Release Execution
Raise, plan, and execute network security changes with complete risk assessment, implementation plans, test evidence, and rollback procedures
Represent network security changes at the Change Advisory Board (CAB), providing technical justification, impact analysis, and dependency detail drawn from CMDB service topology
Actively reduce change-induced incidents through peer review, automated validation, staged rollout, and disciplined post-implementation verification
Schedule and coordinate deployment windows with application, business, and vendor stakeholders to minimise disruption
Operate emergency change process for urgent security containment without compromising traceability or approval integrity
Observability, Logging and AIOps
Onboard network security CIs into monitoring and observability platforms with meaningful metrics, logs, events, and synthetic checks
Ensure complete and reliable log forwarding from all security platforms to SIEM, using FortiAnalyzer and native platform logging, and validate parsing, field mapping, and coverage so detection content is not blind
Use NetScout for service-level and packet-level visibility across inspection points, proving whether a security control is implicated in a performance problem
Define alert thresholds and reduce alert noise so alerts are actionable and correctly routed
Build operational dashboards providing clear visibility of network security health, policy compliance, tunnel and gateway availability, and deployment quality
Support AIOps adoption — anomaly detection, event correlation, service-impact analysis, and predictive insight — including AI-assisted triage of security telemetry using Gemini CLI and Python tooling
Security, Compliance and Resilience
Deploy and operate all network security infrastructure in line with enterprise security architecture, hardening baselines, and least-privilege access principles
Meet patch compliance and vulnerability remediation SLAs across all supported CIs, including Cisco ASA/FTD, FortiOS, and Junos software currency, with evidenced closure
Remediate findings from penetration tests, security assessments, segmentation validation, and internal audit within agreed timeframes
Configure and support high availability and failover for all security enforcement points, ensuring no single control becomes a single point of failure
Maintain configuration backup and rapid device recovery capability, and test restoration rather than assuming it
Maintain audit-ready evidence of policy, configuration, and change history for regulated and GxP-relevant environments
Collaboration, Vendor Coordination and Continuous Improvement
Partner with Enterprise Architecture, Cyber Security, Cloud Engineering, Network Engineering, and Application and Product teams to ensure operational readiness of new platforms and technologies
Translate security architecture and policy standards into deployable, supportable configuration, pushing back constructively where a standard is not operable
Coordinate technical delivery governance with managed-service partners and vendors, validating the quality of delivered work against standards and SLAs, and ensuring meaningful, timely measurement of vendor support using KPIs
Key Performance Indicators
Deployment
Deployment success rate and lead time, from request to validated production
Automation coverage — proportion of security infrastructure and configuration deployed via Terraform, Ansible, Python, and API automation rather than manual console change
Firewall rule request turnaround time, and proportion fulfilled through the automated pipeline
First-time-right deployment rate; rework and rollback frequency
Configuration drift rate and time to remediate detected drift
CI data quality at handover — completeness, correctness, non-orphan, and non-stale on newly deployed CIs
Monitoring, log-forwarding, configuration backup, and patching onboarding coverage achieved at production sign-off
Support
MTTR for supported network security CIs; incident backlog and ageing
Change success rate and change-induced incident rate
Recurring incident rate and Problem closure effectiveness
Software currency across Cisco ASA/FTD, FortiOS, and Junos; patch compliance and vulnerability remediation within SLA
Policy hygiene — reduction in overly permissive, shadowed, redundant, and unused rules; rule recertification completed on schedule, evidenced through AlgoSec
Segmentation and zoning compliance, with audit and penetration-test findings closed within agreed timeframes
SIEM log coverage and integrity across all security platforms
Availability of security enforcement points, including VPN, WAF, and inspection services
DDoS mitigation readiness and activation effectiveness
CMDB data-quality KPIs for owned CI classes, including discovery coverage and staleness
Automation and self-healing adoption; measured manual-effort reduction
Resolution note quality and knowledge-article contribution
About You
Experience
Substantial hands-on experience deploying and supporting enterprise network security infrastructure in large-scale, global, multi-vendor environments
Demonstrable depth in firewall and segmentation engineering, with working knowledge across VPN, cloud security platforms, WAF, and DDoS protection
Practical experience automating network security deployment and configuration with Terraform, Ansible, Python, and vendor APIs
Experience in a regulated industry — pharmaceutical, life sciences, or comparable — is an advantage
Technical Skills – Firewalls and Policy
Hands-on experience with at least two of Cisco ASA/FTD, Fortinet FortiGate (FortiOS), and Juniper SRX
Centralised firewall estate management, including Junos Space for Juniper SRX and native Cisco and Fortinet management platforms
Application-aware and identity-based policy design to least-privilege principles
AlgoSec for policy analysis, change risk assessment, rule-base optimisation, and compliance reporting
FortiAnalyzer for centralised logging, reporting, and forensic review
Threat prevention configuration and tuning — IPS, anti-malware, URL filtering, and TLS inspection
Technical Skills – Segmentation and SDN Security
Network segmentation, zoning, VRF separation, and microsegmentation design and implementation
Cisco ACI security policy — contracts, endpoint groups, and tenant separation configured through Cisco APIC
VXLAN overlays and their security implications in data centre fabric design
Zero-trust network access concepts and practical deployment experience
OT, manufacturing, or laboratory network segregation is an advantage
Technical Skills – VPN, Secure Access and Cloud Security
IPSec and SSL VPN — site-to-site and remote access at enterprise scale, including encryption standards and failover
Zscaler — secure web gateway and private access policy, traffic forwarding and steering, and SSL inspection
SD-WAN security on Palo Alto Prisma SD-WAN (CloudGenix) and FatPipe platforms
Network security on AWS and Azure — security groups and network security groups, cloud-native firewalling, private connectivity, and inspection architectures
Terraform for provisioning cloud network security resources — module design, remote state, plan and apply workflow, and drift detection
Cloud tagging and governance standards
Technical Skills – WAF, Load Balancing and DDoS
Web Application Firewall policy design and tuning on F5, Array, or AVI platforms
DDoS protection services, mitigation policy, and activation runbooks
PKI, certificates, TLS, and cipher standards as applied to network security platforms
Technical Skills – Networking Foundations
Strong TCP/IP, routing and switching, VLANs, NAT, and asymmetric-routing troubleshooting
BGP and OSPF sufficient to understand and troubleshoot path selection through security enforcement points
VRF and VXLAN as they apply to segmentation and multi-tenancy
DNS, DHCP, and IP address management as they relate to security policy and filtering
LAN, WAN, WLAN, data centre, and cloud network architecture on AWS and Azure
Aruba wireless security integration, including authentication and guest access, is an advantage
Automation, Tooling and AI
Terraform — infrastructure-as-code provisioning of AWS and Azure network security resources, including module design, remote state, and plan review as a change gate
Ansible — reusable roles, templates, and inventory management for multi-vendor security configuration
Python — scripting, API consumption, and automated pre- and post-change validation
Selenium — automation of vendor web consoles and portals that expose no usable API
Gemini CLI as an AI agent for policy review, log and capture triage, documentation drafting, and automation scaffolding
Platform APIs — Junos Space, Cisco APIC, FortiGate and FortiAnalyzer, Zscaler, and F5, Array, and AVI
Version control and change pipelines — Git-based workflow for security configuration
Operating systems — Cisco IOS and NX-OS, FortiOS, and working command-line competence on Linux and Windows
Troubleshooting and Diagnostics
Wireshark — packet capture and protocol-level analysis, including SPAN and mirror captures
NetScout — packet-level and service-level performance monitoring and fault isolation across inspection points
Firewall and platform log analysis, including FortiAnalyzer and SIEM-based investigation
Structured fault isolation across physical, data link, network, and application layers
ITSM, CMDB and Observability
ServiceNow — Incident, Problem, Change, Request, and CMDB/CSDM; Discovery and Service Mapping experience strongly preferred
Strong working knowledge of ITIL/ITSM practices, particularly Incident, Problem, and Change Management
Monitoring and observability platforms covering metrics, logs, alert design, and SIEM log onboarding
Exposure to AIOps and intelligent-operations use cases
Behavioural Competencies
Strong ownership mindset — accountable for what you deploy, through to production stability and audit evidence
Security-first judgement, balanced with a pragmatic understanding that availability of business-critical services also protects patients
Calm, structured, and effective under pressure during major incidents and active security events
Rigorous and detail-oriented, with genuine discipline around change control and documentation
Strong analytical and problem-solving skills, able to diagnose across the boundary between network, security, and application layers
Clear communicator, able to explain technical risk in business terms and to say no to an unsafe request with a workable alternative
Collaborative and customer-focused, comfortable working across teams, vendors, and time zones
Automation-first instinct and a continuous-improvement mindset
Preferred Certifications
Firewall and network security — Fortinet NSE 4 to 7, Cisco CCNP Security or CCIE Security, Juniper JNCIS-SEC or JNCIP-SEC
Cloud security and networking — AWS Security or Advanced Networking Specialty, Microsoft AZ-700 or SC-100
Cloud security platform — Zscaler certification (ZDTA or equivalent)
Data centre and SDN — Cisco ACI specialisation or CCNP Data Center
Application and access security — F5 certification, including WAF or application security modules
Automation — HashiCorp Terraform Associate, Red Hat Ansible Automation, Cisco DevNet Associate
Broader security — CISSP or CCSP an advantage
ITSM — ITIL 4 Foundation or Managing Professional; ServiceNow CSA, CAD, or Discovery/CMDB certification
Agile — Certified Scrum or Agile certification
Languages
English required; additional languages an advantage
Pursue Progress. Discover Extraordinary.
Better is out there. Better medications, better outcomes, better science. But progress doesn't happen without people — people from different backgrounds, in different locations, doing different roles, all united by one thing: a desire to make miracles happen. So, let's be those people.
At Sanofi, we provide equal opportunities to all regardless of race, colour, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, or gender identity.
Watch our ALL IN video and check out our Diversity Equity and Inclusion actions at sanofi.com!
Pursue progress, discover extraordinary Better is out there. Better medications, better outcomes, better science. But progress doesn’t happen without people – people from different backgrounds, in different locations, doing different roles, all united by one thing: a desire to make miracles happen. So, let’s be those people.
At Sanofi, we provide equal opportunities to all regardless of race, colour, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, ability or gender identity.
Watch our ALL IN video and check out our Diversity Equity and Inclusion actions at sanofi.com!
Don’t Miss Your Next MNC JobGet job updates in our community›
