Network & Security Engineer

Network & Security Engineer

Baku, Azerbaijan · On-site · Lead · Full-time

We're not hiring someone to keep the lights on. We're rebuilding our enterprise network from the ground up — migrating legacy WAN to Cisco SD-WAN, rolling out SD-Access fabric, and standing up ISE-driven security.

If you live in routing, firewalls and identity — and want real greenfield projects instead of routine maintenance — read on.

Company: Proxima Tech Solutions Location: Baku, Azerbaijan (On-site)

What you'll do

• Design and implement network changes across LAN, WAN, WLAN, SD-WAN, SD-Access and NGFW — including secure branch integrations.

• Lead the migration of traditional WAN to Cisco SD-WAN.

• Build and enforce security policy on next-gen firewalls (Palo Alto, Fortinet, and/or Cisco).

• Manage segmentation, remote-access VPN, and site-to-site IPsec tunnels.

• Drive access control and micro-segmentation policy through Cisco ISE.

• Act as the escalation point for network security incidents.

• Troubleshoot complex, cross-domain issues (Routing / SDA / ISE / Firewalls).

• Keep documentation, diagrams and security policies current.

What we're looking for (must-have)

You don't need to be an expert in every technology below. A strong core plus real depth in a couple of areas is exactly what we want.

• Solid, hands-on routing & switching: OSPF, BGP, EIGRP, route-maps/PBR, VRF-Lite; STP/RSTP, LACP, VLANs/802.1Q on Cisco Catalyst 9000 (Nexus a plus).

• Deep, hands-on experience with at least one leading NGFW platform — Palo Alto (PAN-OS/Panorama), Fortinet (FortiGate/FortiManager), or Cisco Secure Firewall/Firepower (FMC/ASA). Familiarity with the others is a plus.

• Real experience with IPsec site-to-site and remote-access VPN (GlobalProtect, FortiClient, or AnyConnect).

• Hands-on experience with at least one of Cisco ISE, SD-Access, or SD-WAN in production.

• Advanced troubleshooting across intersecting technologies.

Nice to have (a plus, not required)

• Broader NGFW coverage across multiple vendors, plus deep-packet-inspection features (IPS/IDS, URL filtering, SSL/TLS decryption, App-ID/User-ID).

• Cisco SD-Access design (underlay/overlay/fabric) and Catalyst Center (DNA Center).

• Cisco ISE policy design — 802.1X, MAB, WebAuth, profiling, posture, SGT micro-segmentation.

• Cisco SD-WAN control plane (SD-WAN Manager/vManage, vSmart, vBond, WAN-edge).

• Cisco wireless — 9800 WLC, Catalyst APs, FlexConnect, ISE-integrated guest/corporate access.

• Firewall integration with AD/LDAP, MFA/SAML.

• Certifications: CCNP / CCIE, PCNSE, or Fortinet NSE.

What we offer

• Competitive compensation package, based on your experience and skills.

• Real greenfield and modernization projects — SD-WAN migration, SD-Access rollout, ISE deployment — not routine maintenance.

• Certification and training sponsorship (CCNP, PCNSE, NSE and more).

• A clear growth path toward Lead / Architect.

• Modern multi-vendor environment and a team that solves genuinely hard problems.

How to apply

Interested? Apply here on LinkedIn, or send your CV to hr@proximatech.az

Don't meet 100% of the list? Apply anyway. If your routing and security fundamentals are strong, we'll help you grow into the rest.

Proxima Tech Solutions is an equal-opportunity employer.