Senior Cisco Security Engineer

Insight Enterprises is building out its managed Platform Engineering capabilities, bringing together security engineering and platform lifecycle delivery. In this role, you will focus on the Cisco security stack, supporting engineering work across migration, integration into platform design and releases, and secure lifecycle management. You will partner closely with security operations and infrastructure teams to translate requirements into implemented, codified controls.

As the subject-matter expert for Cisco security platforms, you will drive programs spanning Umbrella, Secure Access, Secure Firewall/Firepower, and Cisco ISE, including hands-on migration planning, validation, and ongoing upgrades. You will also contribute to the platform engineering code base by building automation and infrastructure-as-code patterns that codify security standards and recurring maintenance, then ship changes through the team’s feature release cadence.

Core responsibilities

• Serve as program subject-matter expert and engineer for Cisco Umbrella, Cisco Secure Access, Cisco Secure Firewall / Firepower (FMC and FTD), and Cisco Identity Services Engine (ISE).
• Lead Umbrella to Cisco Secure Access migration work, including DNS-security policy migration, Secure Client rollout, and lab/pilot/production validation, with support from Cisco Lifecycle Services.
• Support evaluation and migration of on-premises Firepower Management Center to cloud-delivered FMC via Cisco Security Cloud Control, and migration of FTD remote-access VPN to Secure Access VPNaaS.
• Drive ISE engineering and rollout: policy design, posture and profiling, network access control, upgrades and patching, and contribution to ISE Phase 2 work.
• Provide secure lifecycle management for the Cisco security stack by assessing Cisco PSIRT advisories, planning and executing upgrades and patches, and keeping configurations aligned to best practice.
• Contribute to the Platform Engineering code base by building automation plus infrastructure-as-code and policy-as-code that codify security standards and recurring maintenance, then deliver through the team’s feature release cadence.
• Bridge requirements from Insight’s Managed Security team into deployed, codified controls by translating security policies into implemented platform changes across infrastructure/platform teams.
• Plan and track security engineering work in an authoritative ticket system using two-week sprints, documenting designs, standards, and runbooks.
• Participate in platform design reviews to help ensure new features and services are secure by design.
• Contribute to identity and access improvements as the client identity program matures, including ISE, Duo, and Active Directory / Microsoft Entra ID.

Required experience

• 7+ years in network or security engineering, with at least 3 years hands-on engineering (design, deployment, migration, not only administration) of enterprise Cisco security products.
• Deep hands-on experience with Cisco ISE, including 802.1X, MAB, posture and profiling, TACACS+, pxGrid, policy sets, distributed deployments, upgrades.
• Hands-on experience with Cisco Secure Firewall / Firepower (FMC and FTD), covering access control and intrusion policy, NAT, remote-access VPN, HA, and upgrades.
• Working experience with Cisco Umbrella and/or Cisco Secure Access (DNS security, SWG, ZTNA/SSE) or a comparable SASE/SSE platform such as Palo Alto Prisma or Zscaler.
• Automation and coding skills: Python plus at least one of Ansible or Terraform.
• Comfort working with REST APIs including FMC, ISE, and Umbrella/Secure Access APIs.
• Working knowledge of Git-based workflows and CI/CD, including contributing to a shared code base with code review.
• Experience working in Agile/Scrum teams using Jira, Confluence, and/or ServiceNow.
• Strong written and verbal communication, including the ability to work directly with client engineering leaders.

Technologies you will work with

• Cisco Umbrella, Cisco Secure Access, Cisco Secure Firewall / Firepower, FMC, FTD
• Cisco Identity Services Engine (ISE)
• DNS-security, Secure Client rollout, Cisco Lifecycle Services, Cisco Security Cloud Control, Secure Access VPNaaS
• Cisco PSIRT advisories
• Python, Ansible, Terraform
• REST APIs, FMC APIs, ISE APIs, Umbrella/Secure Access APIs
• Git, CI/CD, infrastructure-as-code, policy-as-code
• Agile/Scrum, Jira, Confluence, ServiceNow
• 802.1X, MAB, TACACS+, pxGrid, NAT, HA
• Duo, Active Directory / Microsoft Entra ID
• Palo Alto Prisma, Zscaler

Location and employment details

• Location: San Francisco, CA (remote)
• Salary: USD 175,000 per year
• Travel: 25% to client sites

Benefits

• Salary up to 175k a year plus full benefits

Preferred qualifications

• Identity and access management experience: Microsoft Entra ID / Active Directory, Cisco Duo MFA, conditional access, privileged access management, identity governance.
• Experience with Cisco Security Cloud Control, cloud-delivered FMC, or Secure Access VPNaaS migration.
• Knowledge of Cisco Secure Network Analytics (Stealthwatch), Cisco ThousandEyes, or Cisco Secure Endpoint.
• Familiarity with OT/manufacturing network environments, or willingness to learn.
• Understanding of platform engineering, SRE, GitOps, or DevSecOps frameworks.
• Certifications such as CCNP Security, CCIE Security, Cisco ISE / SCOR / SNCF specialist; CISSP or similar is a plus.
• Managed services or client-facing consulting experience.
• Palo Alto experience preferred.