Senior Network Security Engineer

Senior Network Security Engineer at Heirs Insurance Ltd

Heirs Insurance is a general insurance company challenging traditional insurance by providing simple and accessible protection for vehicles, homes, business and more.

Senior Network Security Engineer

• Job Type Full Time
• Qualification BA/BSc/HND , Professional Certificate
• Experience 5 years
• Location Lagos
• Job Field ICT / Computer

The Role As Senior Network & Security Engineer, you will design, build, and operate the network and security architecture that keeps this platform private, resilient, and impenetrable. You will own the platform's private cloud networking, zero-trust enforcement, perimeter security controls, and network-level threat monitoring, working closely with the Platform Manager and Platform Manager (Security) to ensure every layer of the network is hardened, observable, and compliant. On a banking platform built for continental scale, the network is the first line of defence, and you own it.

What You'll Do

• Network Architecture: Design and own the platform's end-to-end network architecture, defining topology, segmentation, and connectivity across AWS, Azure, and on-premises environments. Plan a scalable IP addressing strategy with non-overlapping CIDR blocks and dedicated subnets for containers, servers, storage, and management. Front and backend assets must be cleanly separated; no internal service is ever publicly addressable. All decisions must be documented and reflected in version-controlled infrastructure code.

• Network Engineering: Own hands-on engineering of network infrastructure across cloud and on-premises environments, including routing, switching, firewall policy management, VPN setup, and on-premises edge devices (FortiGate, Cisco Nexus 9000). All infrastructure must be written as peer-reviewed code (Terraform, Ansible, Bash), version-controlled, with network security checks integrated into CI/CD. No manual changes to any environment are permitted.

• Zero Trust Enforcement: Implement zero-trust principles platform-wide, no implicit trust anywhere. Every request must be authenticated, authorised, and logged; every network path explicitly permitted, everything else denied by default. Continuously identify and close trust gaps.

• Perimeter & Firewall Security: Own the platform's security boundaries end to end. Externally, the only permitted internet entry point is Cloudflare DDoS protection, WAF, then API Gateway, with rules and configurations tested and enforced as code. Internally, own all firewall and NSG rules across cloud and on-premises environments, defined exclusively via IaC, version-controlled, and regularly reviewed for least-privilege access. No manual firewall or NSG changes are permitted.

• Cloud Network Security & Encryption: Configure and maintain cloud-native network security controls across AWS and Azure, including Security Groups, Network ACLs, AWS Network Firewall, and Azure Firewall. Ensure no storage, database, or service is ever inadvertently exposed to the internet. Enforce TLS 1.2+ everywhere (TLS 1.0/1.1 prohibited) and own the full certificate lifecycle.

• Hybrid & Site-to-Site Connectivity: Design and maintain highly available, redundant connectivity between cloud and on-premises data centres using AWS Direct Connect, Azure ExpressRoute, and IPSec VPN Gateways. Ensure tested failover paths so no single link interrupts core banking connectivity. All links must be encrypted, monitored, and governed as code.

• VPN & Admin Access Controls: Design and operate the platform's JumpNet and VPN infrastructure, the only permitted route for admin access to production, with no exceptions. Enforce MFA on all VPN access and log/monitor all privileged sessions.

• Global Traffic Management: Design and operate global traffic management ensuring user traffic is intelligently distributed across AWS and Azure based on latency, availability, and health, using Route 53/Global Accelerator and Azure Traffic Manager/Front Door with automatic failover. No single cloud environment should be a point of failure.

• Threat Detection & Network Monitoring: Design and operate centralised network monitoring and threat detection, providing real-time visibility into device health, link utilisation, traffic flows, and anomalies. Implement IDS/IPS, anomaly detection, and traffic analysis tooling, feeding all telemetry into the SIEM with alerting tuned for lateral movement, port scanning, unauthorised connections, and control-bypass attempts. No network event goes undetected or unacted upon.

• Incident Response: Act as first responder for network-level security incidents, including containment, isolation, forensic evidence