Forward - Security Engineer, Network & Infrastructure Security

ShyftLabs

10d

About The Position

ShyftLabs is seeking a Security Engineer, Network & Infrastructure Security to support enterprise security initiatives for a client. This client-facing individual contributor role combines technical security expertise with architecture advisory, risk assessment, and cross-functional collaboration. The engineer will partner with client stakeholders in Network Engineering, Infrastructure, Cloud, and Information Security to define, assess, and strengthen controls across enterprise network and infrastructure environments. The role includes advising on security standards and architecture, assessing designs and controls, investigating incidents, supporting compliance, and recommending scalable security improvements.

Requirements

4–6 years of IT or cybersecurity experience, including at least 3 years in network security or infrastructure security engineering, architecture, or advisory roles.
Hands-on experience with enterprise firewall and secure access technologies such as Palo Alto, Fortinet, Cisco, or Zscaler.
Strong understanding of TCP/IP, routing and switching, VLANs, DNS, DHCP, NAT, VPN, and TLS, including the ability to perform packet-level analysis.
Working knowledge of PKI, certificate lifecycle management, enterprise DNS security, and cryptographic key management.
Practical experience with Windows and Linux server hardening, privileged access management, vulnerability remediation, and infrastructure security controls.
Experience with EDR platforms such as CrowdStrike, and SIEM technologies and query languages such as KQL or SPL.
Familiarity with CIS Benchmarks, NIST CSF, and PCI DSS.
Scripting or automation experience using Python, PowerShell, Bash, or similar languages for security assurance, compliance validation, and reporting.
Experience assessing security architecture, reviewing technical designs, documenting standards, and providing actionable recommendations.
Strong communication and stakeholder-management skills, including direct client engagement, explaining technical risks, and influencing engineering decisions.
A consultative, collaborative problem-solving approach that balances security requirements, operational constraints, and business priorities.
Ability to work independently, manage competing priorities, and drive initiatives through assessment, recommendation, and remediation.

Nice To Haves

Experience securing cloud network infrastructure and logging services across AWS, Microsoft Azure, or Google Cloud Platform.
Familiarity with automated certificate management solutions such as ACME or Venafi, and protective DNS platforms such as Infoblox or Cloudflare.
Experience with Infrastructure as Code tools such as Terraform or Ansible, and integrating security guardrails into CI/CD pipelines.
Experience securing distributed enterprise environments, retail edge infrastructure, or IoT/OT networks.
Working knowledge of compliance requirements such as PCI DSS and SOX.
Familiarity with IT service management and change management platforms such as Jira Service Management or ServiceNow.
Relevant security certifications, including CompTIA Security+, Network+, PCNSE, CCNP Security, AWS or Azure Security certifications, or GIAC credentials.

Responsibilities

Define and maintain enterprise security standards, reference architectures, and configuration baselines for firewalls, intrusion prevention and detection systems, web filtering, TLS inspection, and secure web gateways.
Review client network designs and implementations for alignment with security requirements and industry best practices.
Assess client security requirements, provide technical recommendations, communicate risks, and guide architecture and implementation decisions.
Collaborate with engineering teams to translate security requirements into practical, scalable solutions.
Establish and assess standards for VPN and ZTNA solutions, including access controls, device posture requirements, and compliance monitoring.
Establish standards for PKI, certificate authority governance, cryptographic key management, and certificate lifecycle operations; identify certificate-management automation opportunities.
Define security requirements for enterprise and cloud DNS architectures, including protective DNS filtering, DNSSEC, split-horizon DNS, and centralized logging.
Develop and assess segmentation and Zero Trust strategies across corporate networks, retail environments, PCI zones, IoT/OT environments, and third-party connections.
Define and validate hardening standards for Windows and Linux servers, containers, hypervisors, and network appliances; apply CIS Benchmarks and automated compliance tools to detect and remediate configuration drift.
Investigate complex network security incidents, connectivity issues, and remote access failures; conduct root-cause analysis and coordinate remediation with engineering teams.
Ensure network, DNS, proxy, endpoint, and identity telemetry is captured and integrated into SIEM platforms; partner with security operations to improve visibility, detection, and investigation.
Review firewall changes, network designs, infrastructure requests, and security exceptions for risk and compliance.
Promote least-privilege access, accurate configuration and asset records, and consistent security governance.
Develop scripts, tools, and workflows to automate security compliance assessments, firewall rule reviews, configuration validation, and posture reporting.
Assess security controls against CIS Benchmarks, NIST Cybersecurity Framework, and PCI DSS; document findings, recommend remediation, and communicate progress.
Identify opportunities to improve security architecture, reduce infrastructure exposure, standardize controls, and embed secure-by-design principles in engineering processes.