Cloud Network Engineer

Job Overview

This role is focused on owning, maintaining, and evolving Zopa’s cloud-based network architecture and its supporting automation infrastructure. You will play a key part in designing secure, scalable and observable systems across our estate spanning AWS and Azure.

Key Responsibilities

• Design, manage, and evolve the network architecture across multi-account, multi-region AWS environments.
• Implement and support partner integrations through mTLS, IPSec, Privatelink.
• Support centralized network services such as DNS & RADIUS.
• Maintain network security controls using Palo Alto Cloud NGFW (or AWS Network Firewall), Network ACLs, Security Groups.
• Implement and maintain infrastructure codebase and CI/CD pipelines.
• Ensure robust monitoring and alerting using Prometheus, Grafana, CloudWatch, and other observability tools.
• Collaborate on production incident response, provide network level visibility and troubleshooting support.
• Support the security, performance, and resilience of inter-service communication across all Zopa’s cloud & SaaS providers.
• Provide input into broader platform strategy, architecture reviews, and engineering best practices.

Required Qualifications

• Proven experience designing and managing AWS networking: VPCs, Transit Gateways, Route53, PrivateLink, NAT gateways, security groups, etc.
• Practical knowledge of Palo Alto Cloud NGFW and cloud-native firewalling/security principles.
• Familiarity with Azure networking constructs.
• Strong hands-on experience with Terraform as the core IaC tool.
• Proficient in GitHub Actions for infrastructure CI/CD.
• Strong troubleshooting skills, including low-level tools like tcpdump and Wireshark.
• Understanding of TLS protocols, public/private key infrastructure, and x.509 certificate standards.
• Ability to debug certificate validation issues confidently and understand implications of cipher suites, trust chains, and expiry windows.
• Working knowledge of Kubernetes (specifically EKS) including ingress-controllers, ALBs and request handling with external CDN.
• Experience with Prometheus, Grafana, AWS CloudWatch, and centralized logging (e.g. Splunk or similar).
• Ability to set up effective monitoring and alerting for network and connectivity issues.