Cloud Network Security Engineer (GCP Cloud NetSec)

About the role

Applaudo Studios is looking for a Cloud Network Security Engineer who designs, implements, automates and operates network security architecture on Google Cloud Platform (GCP). The role combines corporate networking and firewall fundamentals with hands-on GCP security expertise to secure connectivity and mitigate data exfiltration risks. It is a 3-month assignment (possible extension) in a hybrid setting, 3 to 4 days on site and 1 to 2 days remote, Monday to Friday.

Key responsibilities

• Design, implement, automate and operate the GCP network security architecture.
• Secure the perimeter with Cloud Armor (WAF), hierarchical VPC firewall policies and VPC Service Controls.
• Set up hybrid connectivity with HA VPN and Cloud Interconnect, plus Cloud DNS, Cloud NAT and Load Balancing with IAP under a Zero Trust approach.
• Review Terraform code to prevent insecure configurations and build secure network modules.
• Monitor network activity with VPC Flow Logs, Cloud Logging and Cloud Monitoring, and manage threats with SCC and Cloud IDS.
• Manage encryption with Cloud KMS and Secret Manager, and certificates with CA Service.
• Ensure compliance with CIS Benchmarks for GCP and internal regulations.
• Collaborate with infrastructure and DevOps teams to mitigate data exfiltration risks.

Required profile

• Bachelor's degree in Computer Science, Information Systems or a related field, or equivalent professional experience.
• 2+ years of experience in networking, cybersecurity and corporate firewalls.
• 1+ year of hands-on experience with GCP network and security services.
• Ability to work with infrastructure and DevOps teams; English is required, Spanish is the main language of the project.
• Google Associate Cloud Engineer and/or Google Professional Cloud Security Engineer certification desired.

Required skills

• GCP security services: VPC, Cloud Armor, IAP, VPC Service Controls, Cloud Interconnect, Security Command Center, Cloud KMS.
• Terraform, including IaC reviews and network module development.
• Nice to have: Cloud IDS, Certificate Authority Service, Secret Manager, CIS Benchmarks for GCP compliance and auditing.