Lead Reliability Engineer - Network and Security

Overview

Build and operate the network and security controls that protect Zenoti's cloud estate, partnering with InfoSec, Platform, and Engineering to enforce them.

What you'll do

• Own network architecture and connectivity: design, build, and run the network backbone of a distributed, multi-tenant SaaS estate, including vWAN/hub-spoke, ExpressRoute/VPN, cross-cloud (AWS↔Azure) connectivity, private endpoints, DNS, routing, and segmentation, engineered for redundancy and tested failover.
• Secure the edge and perimeter: run the WAF, DDoS protection, Front Door/CDN, firewalls, and egress control, with no single points of failure, and keep network visibility high through flow analytics and cross-cloud path monitoring.
• Automate everything that repeats: treat network and security as code through secure-by-default Terraform modules, IaC scanning gates, drift detection, policy-as-code (OPA, Azure Policy, SCPs), automated evidence collection, and certificate and secrets lifecycle automation.
• Operate detection, response, and resilience: lead detection engineering, SIEM tuning, and incident command with RCA-to-control feedback loops, plus DR and ransomware-recovery architecture with failover runbooks tested on a schedule.
• Keep the company continuously compliant: maintain a control registry mapped to SOC 2, PCI-DSS, HIPAA, and regional privacy laws, and govern identity, PKI, and encryption in line with InfoSec policy.
• Be the architecture authority and set direction: run design reviews and readiness assessments for new platforms and tools, manage risk-acceptance workflows, own the roadmap, mentor engineers, and give leadership clear, metric-anchored risk reporting.

What you'll need

• 8+ years designing and operating infrastructure in Azure (primary) and AWS, with deep expertise in both network and security.
• Deep cloud networking: vWAN/hub-spoke, ExpressRoute/VPN (IPSec), BGP and routing, DNS, load balancing, private connectivity, and firewall and WAF management, including diagnosing complex cross-cloud connectivity issues.
• Security fundamentals: TLS/PKI, IAM, SIEM, threat analysis, and EDR and vulnerability/patch management across Windows and Linux.
• Strong automation skills: production IaC (Terraform preferred; ARM/Bicep/Ansible a plus), CI/CD pipeline integration, and scripting in Python, PowerShell, or Bash to eliminate manual toil.
• Multi-tenant SaaS architecture: tenant isolation, blast-radius thinking, and data residency across regions, including GDPR and regional laws.
• Workload and data security: Kubernetes (AKS/EKS) hardening, encryption and key management, and SQL Server and PaaS datastore hardening.
• Brownfield pragmatism: migrating legacy estates to secure baselines without outages, through phased adoption.
• Solid command of SOC 2, PCI-DSS, and HIPAA audits, including customer security questionnaires.
• Clear written communication: ADRs, and translating risk into business terms for leadership and auditors.
• Ability to influence through technical depth in a fast-paced, scaling SaaS environment.

Nice to have

• AZ-500/SC-100, AWS Security Specialty, CISSP/CCSP, CKS.