OPTIMUM SOLUTIONS (SINGAPORE) PTE LTD
Senior Network Security Engineer (SASE and Secure Web Gateway)
Senior network security engineer leading a cloud-delivered security edge for a banking environment: architecting Secure Web Gateway, SASE and ZTNA (replacing VPNs), migrating on-prem proxies to cloud SWG, integrating identity (SAML/SCIM), automating via APIs, and supporting MAS TRM audits. Key tech: Zscaler/Netskope-class SSE, Palo Alto/Check Point, Python/Terraform.
- Compensation
- SGD 7K–SGD 10K / mo
- Location
- Singapore
- Work setup
- Not specified
- Seniority
- Senior
- Employment
- Not specified
- Experience
- 4+ years
- Category
- Security
- Posted
Skills
Must have
- Degree in Computer Science, Information Technology, or a related field
- 8-12 years total experience in network or security engineering, with at least 4 years designing and implementing enterprise SSE/SASE platforms (Zscaler, Netskope, Prisma Access, Cisco Secure Access) —
- Led at least one complete migration from an on-premises proxy (Bluecoat/Symantec ProxySG, Cisco WSA, McAfee SWG) to a cloud SWG platform
- Proven experience designing and delivering ZTNA solutions to replace legacy remote-access VPNs
- Deep understanding of HTTP/S, TLS and PKI, proxy/PAC file behavior, DNS, and authentication workflows (SAML, Kerberos)
- Experience integrating identity providers (Microsoft Entra ID or Okta via SAML/SCIM)
- Working knowledge of enterprise firewalls (Palo Alto, Check Point) alongside GRE/IPsec tunneling
- Experience operating under ITIL framework in a regulated environment; strong problem-solving and collaborative, fast-learning mindset
Nice to have
- Hands-on design and implementation experience with Zscaler (ZIA/ZPA), Netskope, or Skyhigh Security SSE
- Experience driving platform evaluations, proofs-of-concept, or platform-to-platform migrations
- Expertise in digital experience monitoring, advanced DLP (EDM/IDM), and browser isolation
- Scripting and automation skills using Python or Terraform for SASE configurations
- SIEM integration experience (Splunk)
- Endpoint management experience for agent deployments (Intune, SCCM, Jamf)
- Prior work experience within the Financial Services sector
- Certifications such as CISSP, CCSP, Netskope NCCSI/NSK200/300, Palo Alto Networks SSE Engineer, Zscaler ZDTA/ZDTE
Full description
About the Role
We are seeking a hands-on and analytical Senior Network Security Engineer to lead the architecture, engineering, and evolution of a cloud-delivered security edge for a leading banking environment. In this role, you will spearhead Secure Web Gateway (SWG), Secure Access Service Edge (SASE), and Zero Trust Network Access (ZTNA) transformations, ensuring robust, secure, and seamless network connectivity.
Responsibilities
- Secure Web Gateway (SWG): Design and maintain web security policy architecture (URL filtering, cloud application control, cloud firewall, file-type/sandbox policies). Engineer SSL/TLS inspection strategies, exemption frameworks, and traffic steering via PAC files, explicit proxies, and GRE/IPsec tunnels. Lead the migration of legacy on-premises proxies to Cloud SWG.
- Zero Trust & SASE: Design and build Zero Trust Network Access (ZTNA) to replace remote-access VPNs. Engineer identity integration with corporate IdPs (SAML, SCIM) and implement CASB, DLP, and data-protection controls for cloud and web traffic.
- Platform Operations & Automation: Maintain platform-independent security policy baselines, perform technical vendor evaluations, and automate configuration management via APIs under version control.
- Governance & Compliance: Deliver engineering runbooks for Change Advisory Board reviews and support rigorous regulatory audits (e.g., MAS TRM guidelines).
Requirements
- Degree in Computer Science, Information Technology, or a related field.
- 8 to 12 years of total experience in network or security engineering, with at least 4 years dedicated to designing and implementing enterprise SSE/SASE platforms (e.g., Zscaler, Netskope, Prisma Access, Cisco Secure Access) — hands-on engineering focus, not end-user support.
- Migration Expertise: Demonstrated success leading at least one complete migration from an on-premises proxy (e.g., Bluecoat/Symantec ProxySG, Cisco WSA, McAfee SWG) to a cloud SWG platform.
- ZTNA Deployment: Proven experience designing and delivering ZTNA solutions to replace legacy remote-access VPNs.
- Core Networking & Security Fundamentals: Deep understanding of HTTP/S, TLS and PKI, proxy/PAC file behavior, DNS, and authentication workflows (SAML, Kerberos).
- Identity & Edge Integration: Experience integrating identity providers (Microsoft Entra ID or Okta via SAML/SCIM) and working knowledge of enterprise firewalls (Palo Alto, Check Point) alongside GRE/IPsec tunneling.
- Experience operating under ITIL framework in a regulated environment; strong problem-solving skills and a collaborative, fast-learning mindset.
Good-to-Have Skills
- Hands-on design and implementation experience with Zscaler (ZIA/ZPA), Netskope, or Skyhigh Security SSE.
- Experience driving platform evaluations, proofs-of-concept (PoC), or platform-to-platform migrations.