In fast changing markets, customers worldwide rely on Thales. Thales is a business where brilliant people from all over the world come together to share ideas and inspire each other. In aerospace, transportation, defence, security and space, our architects design innovative solutions that make our tomorrow's possible.
Network Security Engineer
This position is a hybrid model in our São Bernardo do Campo unit.
Position Summary
Network Security Engineer who blends end-to-end architecture with hands-on engineering, operations, and governance. Design, build, and run secure, resilient, and compliant network infrastructures across on-premises and virtualized environments.
Strong skills in security virtualization, incident response, policy and compliance, risk assessment and mitigation, operations and monitoring, threat modeling and intelligence, IAM, and IT cybersecurity controls, while mastering core networking and modern architecture patterns.
Key Areas of Responsibility
* Implement and harden routing/switching, firewalls, proxies, NAC/802.1X, and encryption controls (TLS, IPsec, MACsec).
* Lead security virtualization initiatives (Virtual firewalls, IDS/IPS, network policies; service mesh mTLS).
* Deploy networking and security controls including security groups and policy-as-code.
* Cybersecurity Operations and Monitoring, Incident Response and Forensics. Cybersecurity Policy, Controls, and Compliance
* Supervise day-to-day security operations, tuning detections and playbooks for network-centric threats; participate in on-call rotations.
* Lead or support triage, containment, eradication, and recovery; perform network forensics using flow data, PCAP, firewall/IDS logs, and threat intel.
* Develop and enforce network security policies and standards (segmentation, firewall rule lifecycle, remote access, DNS/DHCP, PKI/TLS).
* Implement, test, and evidence IT cybersecurity controls across the network stack; support audits and regulatory assessments.
* Align with applicable frameworks and regulations (ISO 27001/27002, NIST CSF/800-series).
* Risk Assessment, Threat Modeling, and Intelligence
* Perform risk assessments for changes, new technologies, and third-party connectivity; maintain risk registers and remediation plans.
* Governance, Documentation, Continuous Improvement, Data Security and Compliance
* Maintain architecture artifacts, diagrams, CMDB, and version-controlled baselines.
* Track metrics (MTTD/MTTR, vulnerabilities, drift, uptime), drive root-cause elimination, and expand automation coverage.
* Mentor engineers and collaborate with SOC, IT Ops, Cloud, and App teams
Minimum Qualifications
* Bachelor’s degree in Computer Science, Information Security, Engineering, or equivalent experience.
* Fluent English
* Enterprise network engineering with last years in security-focused architecture and operations. Hands on experience in AWS/Azure/GCP, K8s, Docker, or other containerization technologies.
* Hands-on expertise with:
o Security virtualization (VMware NSX, IDS/IPS).
o Firewalls, IDS/IPS, proxies, WAF (e.g., Palo Alto, Fortinet, Check Point, Cisco; Snort/Suricata).
o Zero Trust, microsegmentation, NAC/802.1X (Cisco ISE, Aruba ClearPass).
o Incident response and network forensics; playbook development and execution.
o Proficiency with automation/scripting (Python, Ansible, Terraform, Bash/PowerShell) and network APIs (RESTCONF/NETCONF).
What We Offer
* Elective Health and Dental plans.
* Retirement Savings Plan with a company contribution and a match, and without vesting period.
* Company paid holidays, vacation days, and paid sick leave.
* Company provided Life Insurance.
#J-18808-Ljbffr