Department and Project
T-Systems customer Toll Collect operates the truck tolling system for highways and federal roads in Germany. Toll Collect is currently transforming into a broader IT service provider within the Federal Ministry of Transport and intends to leverage its tolling data and experience for additional services. As part of this transformation, the IT platform has been migrated to a modern multi-cloud environment. The new private and sovereign cloud platform, including its automated operating environment, Infrastructure as Code (IaC) and customer ordering portal, is operated and maintained by T-Systems through several specialized infrastructure and operations squads. The network team is looking for additional engineers to operate and continuously improve the network environment and to support new customer requirements and projects.
The team is responsible for the data-center network and network-security infrastructure. Campus/branch LAN and WLAN as well as central Windows/Linux infrastructure services are operated by dedicated teams. Close collaboration with these teams is required for end-to-end troubleshooting and implementation of changes.
Main tasks
As a Network & Security Engineer (Fortinet), you will be part of the team operating and continuously improving the network and network-security infrastructure of a highly available private and sovereign cloud platform across two geographically separated data centers.
Your responsibilities include:
- Operate and troubleshoot the data-center network and network-security infrastructure based primarily on Fortinet technologies.
- Operate and maintain FortiGate firewalls, FortiSwitch infrastructure, FortiWeb WAF, VPN solutions and FortiClient/ZTNA components.
- Implement and troubleshoot firewall policies, NAT, routing, VLANs, VDOMs and network segmentation.
- Operate highly available network components and technologies such as FGCP, MC-LAG/LACP and STP/RSTP/MSTP.
- Analyze incidents and performance issues and perform root-cause analysis across network and security components.
- Implement customer requirements such as firewall changes, new network segments, routing changes and connectivity to internal and external systems.
- Monitor availability, performance and security events and continuously improve monitoring and operational processes.
- Perform lifecycle activities including firmware upgrades, configuration management, backup/recovery and capacity management.
- Support and improve network automation based on Ansible/AWX.
- Operate and support network security services such as VPN, ZTNA and related network connectivity services.
- Contribute to the continuous improvement of the network architecture, operational procedures and security controls in accordance with BSI requirements.
Required skills:
- Strong hands-on experience in operation and troubleshooting of enterprise networks.
- Strong practical experience with FortiGate/FortiOS and FortiSwitch. Experience with additional Fortinet security products such as FortiWeb, FortiClient/ZTNA or Fortinet VPN solutions is highly desirable.
- Operate and troubleshoot FortiWeb WAF services, including virtual servers, server pools, protection policies, certificates, URL/content routing and application-specific security policies.
- Operate and troubleshoot FortiClient/ZTNA and remote-access solutions, including access policies, authentication integration and client connectivity.
- Strong knowledge of TCP/IP, IPv4, VLANs, routing, NAT and firewall technologies.
- Experience with Layer-2/Layer-3 technologies such as LACP/MC-LAG, STP/RSTP/MSTP, BGP and VRRP.
- Experience with VPN technologies, particularly IPSec.
- Experience with high-availability firewall and network architectures.
- Experience working in production environments using incident, change and problem-management processes.
- Basic Linux administration and scripting skills.
- Experience with automation, preferably Ansible/AWX.
- Good understanding of network-security principles.
.
Nice to have:
- Advanced FortiWeb/WAF experience
- Advanced FortiClient/ZTNA experience
- Understanding of infrastructure services such as DNS, DHCP and RADIUS and their interaction with network and security components
- Prometheus/Grafana
- IPv6
- Cisco SD-WAN
- BSI/IT-Grundschutz experience
- SAFe
* Please be informed that our remote working possibility is only available within Hungary due to European taxation regulation.