Job description

very day, Apple’s global remote access, VPN, and secure WAN infrastructure powers critical operations across Apple product engineering teams, Corporate users, retail footprint, manufacturing facilities, and external partner ecosystems. At this scale, a single degraded tunnel, routing misconfiguration, or remote site outage can stall a product launch, halt a supply chain, or disrupt a business-critical integration. You will be the engineer closest to that reality—Engineering, Reliability and operation resilient network security services across Cisco, Palo Alto Networks, and Fortinet platforms where reliability is paramount. This role sits at the intersection of network security Engineering, Reliability, global edge connectivity, and intelligent automation. You will advance our Zero Trust journey by engineering scalable multi-profile VPN services, designing resilient hybrid SD-WAN fabrics, and establishing secure connectivity for remote facilities, 3PL logistics sites, and third-party partners. Just as importantly, you will eliminate operational toil by applying software engineering, infrastructure as code, and agentic AI workflows to evolve our systems from reactive troubleshooting into predictive, self-healing platforms. 8+ years of enterprise experience designing, deploying, and operating global network security, routing, Switching, remote access VPN, and WAN/SD-WAN architectures. Deep firewall & edge platform expertise: Hands-on mastery of Cisco ASA / Firepower, Palo Alto Networks Firewalls, and Fortinet (FortiGate / FortiOS), including security policy architecture, NAT, NAT64 and platform lifecycle management. Large-scale Remote Access & Zero Trust: Proven track record engineering multi-profile SSL and IPsec remote access services (split/full tunnel, device posture, per-app VPN) and integrating with modern ZTNA/SSE architectures. Advanced IPsec & Site-to-Site Connectivity: Deep expertise in IKEv1/IKEv2, PKI/certificate authentication, crypto suites, VTI, DMVPN/FlexVPN, and resilient tunnel architecture for Client to site VPN, partners, 3PLs, and remote sites. Complex Routing & WAN Edge: Advanced BGP and OSPF routing design across hybrid WAN/SD-WAN environments, including carrier peering, traffic engineering (communities, AS-path manipulation), VRF route-leaking, and L2/L3 segmentation. Identity & Access Management Integration: Strong experience integrating network access with enterprise IAM systems—RADIUS, TACACS+, SAML/SSO, MFA, PKI certificate lifecycle, 802.1X, and NAC. End-to-End Troubleshooting & Telemetry: Exceptional packet-level diagnostic skills (pcap, flow analysis, debugs, MTU/path latency issues) across security policies, overlay/underlay networks, and application layers. Infrastructure Automation & Modern Tooling: Demonstrated proficiency automating network security provisioning and validation using Python, REST APIs, Ansible, or Terraform, with bonus experience leveraging AI/LLM-assisted workflows for operations and triage. Bachelor's degree in Computer Science, Information Technology, Computer Engineering, Electrical Engineering, or a related technical discipline, or equivalent practical experience Professional-level network security certifications, such as CCNP Security, PCNSE (Palo Alto Networks), JNCIP-SEC (Juniper), or equivalent demonstrated expertise. Experience leading large-scale network migrations, such as transitioning legacy VPN and MPLS footprints toward modern Zero Trust (ZTNA), SASE, or SD-WAN architectures. Background in hybrid cloud networking (AWS, Azure, or GCP), including cloud edge firewalls, transit architectures, and dedicated interconnects (Direct Connect / ExpressRoute). Track record of applying software engineering and emerging AI/agentic workflows (Python, CI/CD, IaC, GenAI, Claude) to automate security provisioning and eliminate operational toil. History of cross-functional technical leadership, with experience driving SLO-based reliability, security standards, and operational excellence beyond your immediate team.

Requirements

Must-haves

8+ years of enterprise experience designing, deploying, and operating global network security, routing, Switching, remote access VPN, and WAN/SD-WAN architectures.
Identity & Access Management Integration: Strong experience integrating network access with enterprise IAM systems—RADIUS, TACACS+, SAML/SSO, MFA, PKI certificate lifecycle, 802.1X, and NAC.
End-to-End Troubleshooting & Telemetry: Exceptional packet-level diagnostic skills (pcap, flow analysis, debugs, MTU/path latency issues) across security policies, overlay/underlay networks, and application layers.
Bachelor's degree in Computer Science, Information Technology, Computer Engineering, Electrical Engineering, or a related technical discipline, or equivalent practical experience
Professional-level network security certifications, such as CCNP Security, PCNSE (Palo Alto Networks), JNCIP-SEC (Juniper), or equivalent demonstrated expertise.
Experience leading large-scale network migrations, such as transitioning legacy VPN and MPLS footprints toward modern Zero Trust (ZTNA), SASE, or SD-WAN architectures.
Background in hybrid cloud networking (AWS, Azure, or GCP), including cloud edge firewalls, transit architectures, and dedicated interconnects (Direct Connect / ExpressRoute).
Track record of applying software engineering and emerging AI/agentic workflows (Python, CI/CD, IaC, GenAI, Claude) to automate security provisioning and eliminate operational toil.
History of cross-functional technical leadership, with experience driving SLO-based reliability, security standards, and operational excellence beyond your immediate team.

Nice-to-haves

None flagged.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

aipythonrestllmawsazuregcpci/cd

Platform: apple
Effort: medium

Benefits

Benefits detected in the listing.

Vision

Pto