Senior Security Operations Lead — Digital Networks

Overview

Senior individual contributor and hands-on subject-matter expert for Philips Digital Networks, providing deep technical authority for the firewall, proxy and secure-access estate, acting as the break-glass escalation point, and keeping the estate audit-ready.

What you'll do

• Own the Cisco Secure Firewall estate (FTD / FMC / ASA / Firepower): rule lifecycle and hygiene, HA, FMC upgrades and migrations, perimeter and internal segmentation.
• Manage proxy and web security, including PAC file management at global scale (including China and other high-latency or restricted regions), proxy policy and SSL/TLS inspection.
• Run Secure Service Edge / SASE with Zscaler (ZIA / ZPA) and Cisco Umbrella as the primary platforms.
• Manage remote and site connectivity: IPSec / SSL VPN, AnyConnect / Secure Client, site-to-site (S2S), out-of-band management (OOBM) and partner access (S2S / VDI).
• Manage identity and access with Cisco ISE / AAA.
• Manage certificates and PKI: certificate lifecycle and expiry management, TLS, and closed-loop certificate automation.
• Lead vulnerability and advisory response: PSIRT cadence, patching and upgrade lifecycle across the estate.
• Hold L3/L4 escalation authority with Cisco TAC, Zscaler and managed-service partners as the break-glass engineer for P1/MI incidents (firewall HA failures, FMC migrations, PSIRT response).
• Write and maintain automation in Python, Ansible and Terraform against vendor REST APIs (Cisco FMC, Zscaler, ISE, IPAM/DNS such as Efficient IP), including safe bulk rule changes and PAC at scale.
• Maintain a lab/sandbox to test changes and upgrades before production.
• Liaise with Cloud Infrastructure, Security, DNS, IPAM and Active Directory teams to secure and enable network connectivity across AWS, Azure, GCP and China cloud: security groups, NACLs, NVA / cloud firewalls, Cloud On-Ramp, ExpressRoute/DX, TGW/VNet peering, SSE PoP integration and CSPM signal handoff.
• Drive the firewall, proxy and SSE domain to a predictable run model: ITSM discipline, RCA, change governance, and SLA/KPI ownership.
• Act as senior ServiceNow change approver for firewall, proxy, VPN and other security-touching changes, and as technical reviewer on the change/technical review board.
• Keep the estate audit-ready (NIS2, ISO 27001, healthcare-grade) with defensible evidence and change-to-change-record traceability.
• Maintain the domain security risk register and support DR / security tabletop drills.
• Hold managed-service and OEM partners (Cisco, Zscaler and relevant MSPs) technically accountable for delivery quality.
• Run structured stakeholder engagement, leadership, vendor and audit communications, and escalation as a discipline (thresholds, pathways, ownership).
• Own partner service delivery (quality, milestones, acceptance, security), RFP technical evaluation, and the technical substance behind commercial and contractual oversight (sizing, ROI, lifecycle, licenses, renewals, exit clauses).
• Work alongside engineers, set the hands-on bar for the team, mentor junior engineers and interns, and represent the domain in change and architecture review boards.

What you'll need

• Approximately 10–15 years in enterprise network security, with deep and current hands-on depth on Cisco Secure Firewall and at least one major proxy/SSE platform.
• Current and active CCNP Security (350-701 SCOR core plus a relevant concentration exam).
• At least one current SSE vendor credential; Zscaler is preferred.
• Hands-on with Cisco FTD / FMC / ASA / Firepower, ISE, Zscaler ZIA / ZPA, Cisco Umbrella, PAC files, and PKI / TLS.
• VPN experience with IPSec / SSL / AnyConnect / site-to-site / OOBM solutions.
• Automation with Python, Ansible, Terraform and REST APIs.
• AIOps / observability experience with Splunk or equivalent.
• ITIL v4 ways of working and strong RCA discipline.
• Audit literacy in NIS2 and ISO 27001.
• Clear, direct, plain-English communication.

Nice to have

• 300-710 SNCF (Securing Networks with Cisco Firewalls) is highly preferred or willingness to obtain it.
• 300-730 SVPN (Secure VPNs) and 300-715 SISE (Identity Services Engine) certifications.
• ITIL Expert / Managing Professional.
• CISSP / CISM / CCSP.
• AWS Security Specialty / Azure Security Engineer.
• Palo-Alto, Netskope or Cloudflare One exposure.
• Healthcare or regulated-industry audit experience.

Details

• Location: Bangalore.
• Role type: senior individual contributor / hands-on subject-matter expert with mentoring.
• Office-based teams work in person at least 3 days per week.