Zayn Mahmood

Senior Network & Security Engineer with extensive hands-on experience in owning, operating, stabilising, and recovering complex network and security platforms across Defence, Government, ISP, MSP, and large enterprise environments. Trusted technical authority and incident owner for high-severity (P1/P2) network and cyber incidents, responsible for complete lifecycle management, including impact assessment, containment, root-cause analysis, remediation, and service restoration. Highly experienced in designing, building, and supporting secure LAN, WAN, and large-scale SD-WAN infrastructures, translating bespoke application, regulatory, and business requirements into resilient, scalable, and compliant network and firewall architectures.

Comfortable operating within high-assurance and security-sensitive environments, adhering to strict change control, audit, and information-handling standards. A confident customer-facing engineer who builds trust through clear communication, ownership, and consistent delivery. Experienced in working directly with security teams, SOCs, vendors, and senior stakeholders.

Strong advocate of Secure-by-Design principles, operational resilience, and continuous service improvement. Willing and able to travel globally to support critical incidents, customer deployments, and new technology rollouts.

Network Security Engineer - Lions Europe

(2025-05)

• Built, supported, and recovered production LANs and global WAN infrastructures in security-sensitive environments.
• Delivered hands-on implementation and ongoing support for routing protocols (OSPF, BGP) across multi-site and wide-area networks, including inter-site redundancy and failover tuning.
• Designed, configured, and maintained VPN and network security infrastructure, including IKEv2, IPsec, SSL VPNs, and next-generation firewalls (NGFW), ensuring secure remote access and encrypted site-to-site connectivity.
• Acted as incident owner for all network and security outages, leading fault isolation, rapid remediation, and service restoration, often coordinating with internal teams, external vendors, and key stakeholders under tight SLAs.
• Produced and implemented High-Level Designs (HLDs), Low-Level Designs (LLDs), standard operating procedures (SOPs), configuration guides, and change documentation for all new deployments and updates.
• Supported Secure-by-Design principles by conducting lab testing, proof-of-concept (PoC) trials, and vulnerability assessments before production deployment, mitigating risk and improving resilience.
• Monitored and analysed network performance and security telemetry, identifying anomalies, mitigating potential threats, and recommending proactive infrastructure improvements.
• Led configuration and optimisation of firewalls, routers, and switches, including VLANs, ACLs, routing policies, and high-availability clusters, reducing latency and improving redundancy across multiple sites.
• Managed complex IP addressing schemes, subnetting, and routing tables, ensuring efficient use of network resources and minimal downtime during upgrades or migrations.
• Coordinated cross-team and cross-vendor initiatives, including patching, firmware upgrades, and network migrations, ensuring smooth execution without disruption to business services.
• Mentored junior engineers and provided knowledge transfer sessions, improving team capability in firewall management, routing, VPNs, and incident handling.
• Delivered regular network and security reports to management, including incident post-mortems, performance metrics, and recommendations for strategic improvements.
• Worked on multiple concurrent projects, balancing day-to-day incident management with proactive upgrades, optimisation tasks, and architecture improvements.
• Coordinated cross-functional teams during security audits, ensuring compliance with internal and external standards.

Network Security Engineer - Cloud P Limited

(2024-05 - 2025-05)

• Senior technical owner for customer network and security incidents, coordinating investigation, mitigation, and recovery during P1/P2 outages. Applied modern engineering practices, including structured change management, automation, testing, rollback control, and continuous service improvement.
• Designed, deployed, and supported high-availability Juniper SRX4100/5400 firewall clusters using RETH interfaces and VRRP.
• Administered and optimised Check Point R80.40 NGFW environments, managing IPS, Application Control, URL Filtering, Anti-Malware, and Identity Awareness.
• Designed structured and scalable firewall rulebases using ordered layers, access roles, and dynamic objects.
• Engineered IPsec VPN architectures (star, mesh, GRE/IPsec) with certificate-based authentication and tested failover.
• Delivered detailed HLDs and LLDs for hybrid and cloud-connected security solutions.
• Implemented Azure networking and security controls including VNET peering, NSGs, ASGs, and VPN connectivity.
• Integrated firewall telemetry, NSG flow logs, and vulnerability outputs into Azure Sentinel for proactive security monitoring.
• Built strong customer relationships through clear communication, technical ownership, and reliable delivery.

Senior Network Engineer (Security) - Node4 Ltd

(2024-01 - 2024-05)

• Senior escalation engineer within a 24/7 MSP environment, resolving complex network and security P1/P2 incidents within strict SLAs.
• Designed, configured, and supported IPsec and SSL VPN solutions with RADIUS and LDAP authentication.
• Led centralised firewall management using FortiManager, deploying policy packages with revision control and global ADOM governance.
• Integrated FortiAnalyzer for NGFW event monitoring, security analytics, and compliance reporting.
• Supported Cisco ISR4451 and ASR1001-X routers for WAN connectivity using BGP, OSPF, and static routing.
• Assisted with data centre edge and core connectivity using Cisco Nexus 9000 platforms (vPC, HSRP, L3 interfaces).
• Configured and supported Juniper SRX firewalls, Meraki switching, and enterprise wireless deployments.
• Authored LLDs, build guides, diagrams, and customer-specific firewall templates.
• Remediated vulnerability findings and delivered regular customer security posture reviews.

SD-WAN Engineer - Fujitsu (MoD / Defence)

(2023-06 - 2024-01)

• Engineered SD-WAN architectures using Cisco Viptela, delivering secure, scalable, and resilient WAN connectivity across hybrid cloud and on-prem environments.
• Integrated Cisco Viptela SD-WAN with Juniper SRX firewalls to provide unified edge security and consistent policy enforcement across distributed sites.
• Configured advanced routing infrastructures using Juniper MX104, MX480, and MX960 routers, deploying IS-IS and BGP to support scalable VPLS and MPLS-based inter-site connectivity.
• Developed and maintained granular Junos firewall policies, including UTM features, NAT, and IPsec VPNs, supporting site-to-site, hub-and-spoke, and remote-access VPN architectures.
• Executed load testing and failover drills using Zabbix and SEVONE, validating firewall cluster resilience, performance, and failover behaviour under simulated real-world traffic conditions.
• Provided 24/7 Tier-2 support for firewall and SD-WAN platforms, leading root-cause analysis and rapid remediation of critical incidents, including IPsec tunnel failures, key mismatches, and access control issues.
• Collaborated closely with security teams and network architects to integrate SD-WAN and firewall policies into broader secure-by-design network security frameworks, improving consistency and operational efficiency.

Firewall Engineer - Fujitsu

(2019-04 - 2023-06)

• Owned, operated, and continuously improved large-scale enterprise firewall estates across Fortinet, Check Point, Cisco, and Juniper platforms within highly regulated environments.
• Acted as senior technical escalation point for complex firewall, VPN, and network security incidents, providing rapid fault isolation, root-cause analysis, and service restoration.
• Designed, implemented, and optimised Fortinet FortiGate HA clusters (300E, 1000D), including advanced security policies, application control, IPS, SSL inspection, and NAT strategy.
• Administered Check Point R80.x environments, managing layered rulebases, threat prevention blades, identity-aware policies, and secure site-to-site and remote-access VPNs.
• Supported Cisco ASA and Firepower Threat Defense (FTD) platforms, delivering secure remote access VPNs, IPsec tunnels, and intrusion prevention policies.
• Delivered secure hybrid connectivity between on-premise infrastructure and Azure/AWS environments, including IPsec VPN integration and firewall policy alignment.
• Led firewall change lifecycle activities, producing detailed change plans, rollback procedures, and implementation runbooks, and presenting changes through CAB.
• Conducted firewall rulebase reviews, policy optimisation, and vulnerability remediation to improve security posture, performance, and audit compliance.
• Collaborated closely with SOC, infrastructure, and application teams to align firewall controls with business, regulatory, and security requirements.
• Produced and maintained detailed design documentation, operational runbooks, and knowledge-transfer materials to support long-term service stability.

Network & Security Engineer - 247 IP Networks

(2016-11 - 2017-03)

• Delivered network and security engineering services across multi-vendor customer environments.
• Performed penetration testing and vulnerability assessments against networks, firewalls, and web-based applications.
• Conducted firewall installations and integrations including Cisco ASA 5516-X with Firepower services and Check Point R80 firewalls.
• Supported VPN design, implementation, and troubleshooting (IPsec, site-to-site, remote access).
• Maintained and restored network connectivity across routed and switched LAN/WAN environments.
• Troubleshot redundancy technologies including HSRP, VRRP, and firewall failover.
• Supported IPv4 and IPv6 subnetting and address allocation.
• Used Wireshark and lab environments for traffic analysis, fault replication, and issue resolution.
• Produced network documentation, cabling diagrams, and Visio network designs.
• Carried out network audits, monitoring (SNMP), and performance troubleshooting.

Support Engineer - Clear Vision Eyewear

(2016-11 - 2017-03)

• Provided first-line and second-line support, logging, owning, and resolving incidents.
• Diagnosed and escalated network and security issues to specialist teams where required.
• Assisted with hardware installation, patching, and device replacement.
• Supported endpoint security including anti-virus and malware protection.
• Built strong customer service and communication skills while working in a live support environment.