DL
Network Cloud Security
Diverse Lynx India
- 🇺🇸 United States
- On-site
- Staff / Principal
- 22 hours ago
- WAF
- Wiz
- Microsoft Defender
- AI
- RBAC
- F5
- Cisco
- DLP
- Network Security
- ServiceNow
- CI/CD
- AppSec
- VPC
- Zero Trust
- DDoS Mitigation
- CISSP
- CCSP
- ITIL
- AWS
- Azure
22 hours ago
Provide governance, configuration review, posture management and risk oversight across network and cloud security domains for a 20-FTE team spanning firewall/WAF/NAC governance, proxy/remote access, cloud security posture management, and microsegmentation across ~8,000 cloud VMs and ~470 firewalls.
Key Responsibilities
- Own the network and cloud security governance operating model across Firewall/WAF/NAC Governance, Proxy/Remote Access/Cloud FW Monitoring, Cloud Security Governance, and Microsegmentation Governance sub-tracks.
- Drive policy compliance and continuous risk reduction across network and cloud security domains, distinct from architecture (which remains out of scope for this tower).
- Own the Wiz CNAPP governance platform (CSPM, CIEM, CWPP, code security, EASM) plus Microsoft Defender for Cloud and AI-SPM tooling.
- Own the 16-week transition plan for Network & Cloud Security Governance, including RBAC governance-statement sign-off.
- Own firewall rule review and orchestration (Tufin, Panorama, Checkpoint MDS), WAF policy (F5) and NAC enforcement (Cisco Client, Forescout) with exception management.
- Own secure remote access governance (Checkpoint AoVPN), web proxy/DLP policy (Netskope), and cloud-hosted firewall/DDoS monitoring (Imperva).
- Own the Zero Networks and Guardicore microsegmentation platforms, including governance of segmentation standards, policies and security controls.
- Lead a 20-FTE team across 4 sub-tracks: Firewall/WAF/NAC Governance (4 FTE), Proxy/Remote Access/Cloud FW Monitoring (4 FTE), Cloud Security Governance (7 FTE), and Microsegmentation Governance & Platform Ops (3 FTE), plus 2 dedicated Governance Leads.
- Own 24x7 coverage for network and cloud security governance operations.
- Develop specialist capability across Wiz CNAPP, firewall orchestration, and microsegmentation platforms.
- Act as the escalation point of contact for Network Security Governance Lead and Cloud Security Governance Lead counterparts.
- Coordinate with application teams for remediation of cloud misconfigurations, providing tailor-made remediation plans beyond default tool recommendations.
- Manage vendor relationships with Wiz, Tufin, Palo Alto, Checkpoint, Netskope, Cisco, F5 and Guardicore/Zero Networks.
- Sit within the Authorise control band of the ISC Segregation-of-Duties model (Govern & Approve) — accountable for approvals and oversight, with no execution or configuration rights on production systems.
- Act as the first point of accountability for tower-level issues (Escalation Matrix Level 1 — ISC Track Lead), escalating cross-tower dependencies or SLA breaches beyond agreed thresholds to the ISC Delivery Lead.
- Own service delivery governance for the tower: SLAs, KPIs, reporting cadence, and escalation point of contact, in line with the ISC Operations Lead governance model.
- Participate in daily/weekly stand-ups, monthly service reviews, and quarterly governance boards; present tower performance, risk register updates, and continuous-improvement backlog.
- Provide independent, audit-ready evidence of control operation to the ISC Service Delivery Lead / Governance & Audit function on a read-only basis.
- Own the RBAC governance statement across detection tools, ServiceNow SecOps, CI/CD pipelines, approval workflows, reporting dashboards, and production-system access.
- Report on the cross-access boundary matrix compliance, including access provisioning, monitoring/audit, and revocation/offboarding SLAs (24-hour standard revocation, 1-hour emergency revocation).
- Drive regular cleanup and optimization of network security policies to reduce firewall/NAC rule sprawl.
- Own tuning and optimization of Wiz alert rules/policies to reduce false positives in cloud posture management.
- Track future-proof tooling flexibility initiatives (e.g., new CNAPP capabilities, AI-SPM evaluation).
- Enforce segregation of duties: approval authority always separated from execution authority; AppSec/network testers cannot approve or deploy fixes.
- Ensure all privileged actions (approvals, exceptions, config changes) require MFA and are logged in ServiceNow SecOps.
- Own access revocation within 24 hours of role change/termination, and emergency revocation within 1 hour of a security-incident trigger.
- Strong understanding of cloud security posture management (CSPM/CIEM/CWPP), firewall/NAC governance, and microsegmentation architectures
- Familiarity with SDN/VNET/VPC-based cloud network architectures and Zero Trust network principles
- Working knowledge of DDoS mitigation, WAF policy management, and remote-access (VPN) governance
- CISSP or CCSP (Certified Cloud Security Professional) — preferred
- ITIL Foundation — preferred
- Vendor certification (Palo Alto, Checkpoint, or Wiz) — preferred
- 10+ years in network security or cloud security governance, including 4+ years leading enterprise governance teams
- Proven experience governing large-scale firewall estates (400+ firewalls) and cloud environments (5,000+ VMs)
- Demonstrated experience with CNAPP/CSPM platform governance in multi-cloud (AWS, Azure) environments
- Experience with microsegmentation platform governance (Zero Networks, Guardicore, Illumio)
- Exposure to OT network security governance
- Experience developing custom remediation plans beyond default CSPM tool recommendations
- Network/Cloud Security Governance SLA attainment (~30 tickets/day within SLA)
- Zero P1 incident leakage post-transition
- Cloud misconfiguration remediation cycle time
- Firewall/NAC policy review and cleanup cadence compliance
- Access revocation SLA compliance (24-hour standard, 1-hour emergency)
Network Cloud Security · Diverse Lynx India