Position Summary

This Deployment Engineer role sits within the client's Global Deployment Center — the team responsible for executing network change across a global estate of roughly 34,000 devices, spanning data centers, branch offices, ATMs, and low-latency trading infrastructure. The Global Deployment Center is the organization's generalist execution function, working alongside specialist peer squads that each own a specific domain: firewalls and security, data center systems, user connectivity, and trading infrastructure.

The team's current dominant workstream is a multi-squad migration from Check Point to Fortinet. But the role's real mandate is broader and ongoing: safely executing high-volume, high-risk change — firmware upgrades, policy rollouts, platform migrations — across a large, globally distributed, and heavily regulated network. The platforms in play will keep evolving. What the team needs is an engineer who has already shown they can operate calmly and competently through that kind of change, not just expertise in today's toolset.

Key Responsibilities

• Execute phased, wave-based deployments — firmware upgrades, policy changes, platform migrations — across large, globally distributed device fleets, sequencing rollouts around regional and time-zone constraints.

• Diagnose and triage failures mid-rollout, including partial or regional failure patterns with no obvious cause, and make sound, defensible calls on whether to pause, narrow scope, or continue.

• Support the current Check Point to Fortinet migration: analyze existing policies, NAT, and VPN configurations, and translate them into FortiGate equivalents.

• Configure, deploy, and optimize FortiGate firewalls, and manage rollouts through FortiManager, including HA-aware upgrade sequencing.

• Present and defend planned production changes through formal Change Advisory Board (CAB) review, including justifying phased or pilot rollout strategies to risk-averse stakeholders.

• Participate in structured change management: maintenance windows, MOPs, pre/post-change validation, and rollback planning.

• Collaborate across NetDevOps, SRE, and adjacent specialist squads to coordinate cross-team change and share operational context.

• Build and run pre- and post-change validation checks using scripting and automation (e.g., Python) to reduce manual error during high-volume rollouts.

• Navigate and escalate issues appropriately within a large, layered organization — including raising process or documentation gaps constructively when discovered.

Required Skills

• 3+ years of network deployment or network security engineering experience, ideally including large-scale (10,000+ device) enterprise environments.

• Fortinet FortiGate and FortiManager experience, including centralized, multi-region policy and rollout management.

• Demonstrated experience managing at least one significant platform transition or technology migration in production. Check Point-to-Fortinet experience is a plus but not mandatory — equivalent migration experience is acceptable.

• Cisco routing and switching expertise.

• VPN technologies (IPSec, SSL VPN, Site-to-Site VPN).

• High Availability (HA) firewall deployment and upgrade experience.

• Comfort operating within formal change management frameworks (CAB, MOPs, maintenance windows) in a regulated environment.

• Strong troubleshooting skills, including reasoning through ambiguous or non-reproducible failures at scale.

• Basic automation/scripting ability (e.g., Python) for operational validation.

Preferred Skills

• Check Point firewall administration experience.

• Fortinet NSE 4/5/7 certifications.

• CCNP or CCNP Security.

• Arista networking experience.

• Financial services or other highly regulated industry experience.

• Prior experience in a shared, generalist operations function alongside specialist engineering teams.

What Success Looks Like in This Role

• Stays calm and clear-headed when a rollout partially fails and the cause isn't obvious yet.

• Can walk into a CAB meeting and make a credible case for a phased, risk-managed change plan.

• Treats an unfamiliar platform as a gap to close, not a blocker — and can point to having done it before.

• Knows when to solve something directly and when to bring in the team.