Lead Consultant - Network Security

We are looking for a Lead Consultant who will design, build, and manage secure, compliant network segmentation connecting regional environments to Global networks. This position utilizes a standardized security toolset, including Check Point Security Gateways, Palo Alto Networks next-generation firewalls, Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), and Cloudflare for DDoS protection, WAF, and application security. The role combines architectural design, hands-on engineering, automation, and L3/L4 operational leadership to provide policy-driven connectivity that meets strict regulatory and operational standards.

Unlock the potential of remote work in Kazakhstan, giving you the flexibility to work from home or access our offices in Astana, Almaty or Karaganda. Responsibilities

• Establish trust zones, routing boundaries, and inter-zone controls across regional and Global Networks, addressing north-south and east-west traffic, micro-segmentation for sensitive layers, and explicit cross-border allow-lists
• Create HLD/LLD documentation, threat models, and control mappings that align with internal standards and regional regulations to support secure communication between regional and Global customer sites
• Build and manage dual-vendor firewall perimeters with defined control distribution, HA/cluster architecture, predictable failover, NAT domain strategy, SSL/TLS inspection governance, and jurisdiction-tuned Threat Prevention/WildFire/URL filtering
• Configure ZIA to provide identity-aware egress controls, jurisdiction-sensitive SSL inspection bypasses, inline CASB/DLP, and governance for approved SaaS applications
• Deploy ZPA to enable per-application zero-trust access, including connector placement, posture verification, conditional access, and app segmentation to replace legacy VPN solutions where possible
• Architect and implement Site-to-Site VPN (IPSec), Cloud Interconnect/Partner Interconnect equivalents, and BGP-based dual-tunnel HA per site to support hybrid cloud connectivity
• Roll out Cloudflare Magic Transit/Magic WAN, WAF Management, and rate limiting for internet-facing services, integrating with on-premises perimeters for layered protection
• Design SD-WAN/MPLS/SASE pathways featuring policy-based routing, robust encryption, and jurisdiction-specific key custody and rotation practices
• Convert regulatory and internal control mandates into actionable technical controls covering logging, data residency, TLS inspection scope, and lawful intercept requirements
• Consolidate telemetry from firewall, Zscaler, and Cloudflare platforms into SIEM following regional data handling policies, and develop detection rules for cross-border anomalies and policy drift
• Direct L3/L4 incident response efforts, coordinate containment measures, and oversee RCAs with documented corrective actions
• Oversee firewall, Zscaler, and Cloudflare policy management using Terraform/Ansible and vendor APIs, and establish CI/CD pipelines incorporating policy linting, unit testing, and path simulation

Requirements

• 5+ years of experience in network security architecture and operations, specializing in cross-border or multi-region connectivity
• Expertise in Check Point Security Gateways, Palo Alto Networks next-generation firewalls, and Panorama management
• Proficiency in Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) for zero-trust architecture
• Skills in Cloudflare Magic Transit/Magic WAN, WAF Management, and DDoS mitigation strategies
• Knowledge of cloud hybrid connectivity, including Site-to-Site VPN, Cloud Interconnect, and BGP routing
• Background in SD-WAN, MPLS, and SASE architectures with policy-based routing and strong encryption protocols
• Understanding of regulatory and compliance frameworks relevant to data residency, TLS inspection, and lawful intercept
• Familiarity with SIEM platforms and telemetry normalization for cross-border security monitoring
• Competency in Terraform, Ansible, and vendor APIs for policy-as-code and CI/CD pipeline integration
• Capability to lead L3/L4 incident response and conduct root cause analysis with corrective action planning
• English proficiency at B2 level or higher

We offer

• We connect like-minded people:

• Delivering innovative solutions to industry leaders, making a global impact

• Enjoyable working environment, whether it is the vibrant office or the comfort of your own home

• Opportunity to work abroad for up to two months per year

• Relocation opportunities within our offices in 55+ countries

• Corporate and social events

• We invest in your growth:

• Leadership development, career advising, soft skills and well-being programs

• Certifications, including GCP, Azure and AWS

• Unlimited access to EPAM's internal learning database

• Free English classes with certified teachers

• Discounts in local language schools, including online courses for the Kazakh language

• We cover it all:

• Participation in the Employee Stock Purchase Plan

• Monetary bonuses for engaging in the referral program

• Medical & family care package

• Six trust days per year (sick leave without a medical certificate)

• Coverage of psychology sessions of your choice

• Benefits package (sports activities, a variety of stores and services)

• Housing support program: preferential mortgage access via Otbasy Bank partnership

EPAM is global leader in AI transformation engineering and integrated consulting, serving Forbes Global 2000 companies and ambitious startups. With over thirty years of expertise in custom software, product and platform engineering, we empower our clients to become AI-Native enterprises, driving measurable value from innovation and digital investments.