Description
Technical Design Authority– Secure Networks
Department: Connectivity
Employment Type: Permanent
Location: London, UK, Remote, UK, Remote
Why this role exists
- We’re expanding to deliver a wave of customer network transformations. The TDA is our post-sales technical lead and trusted advisor, responsible for shaping and delivering robust designs, guiding customers through SD-WAN and SASE adoption, and ensuring implementations land cleanly into service.
- You’ll be hands-on enough to own Low Level Design and Migration Runbooks and cut-through on complex problems, yet customer centric enough to build confidence, challenge constructively, and become 'first call' for strategic technical decisions.
Experience we’re looking for
• Track record delivering multi-site SD-WAN/SASE transformations as the lead designer/authority.
• Evidenced 'trusted advisor' relationships with enterprise or public-sector customers.
• Hands-on with Fortinet SD-WAN/SASE/ ZTNA in production, including policy design and troubleshooting.
• Comfortable guiding engineers and challenging scope/assumptions to keep delivery on track.
• Track record delivering multi-site SD-WAN/SASE transformations as the lead designer/authority.
• Evidenced 'trusted advisor' relationships with enterprise or public-sector customers.
• Hands-on with Fortinet SD-WAN/SASE/ ZTNA in production, including policy design and troubleshooting.
• Comfortable guiding engineers and challenging scope/assumptions to keep delivery on track.
Key Responsibilities
What you’ll do
• Own solution design: Produce high-quality High-Level and Low-Level Designs for SDWAN, Secure SD-Branch and SASE, integrating NGFW, ZTNA, and Cloud-connect, aligned to customer outcomes and delivery constraints.
• Lead delivery technically: Act as Design Authority across project phases, providing technical governance, standards, and 'go/no-go' on design changes; assure quality of build, test and service transition artefacts.
• Be the trusted advisor: Run customer workshops, translate business drivers into technical decisions, challenge assumptions, and guide stakeholders through risk/benefit trade-offs for transformation programmes.
• Close the loop with pre-sales: Review RFPs/RFIs and proposed architectures, contributing design options, scope assumptions, and delivery estimates that can be sold and delivered on time and within budget.
• Harden security posture: Define and validate SASE/Zero-Trust policies, ZTNA access models, identity-aware segmentation, and secure site templates; align with Nasstar security frameworks and customer policies.
• Operational handover: Ensure designs are operable: documentation, config standards, test plans, knowledge transfer and run-books to transition smoothly into support.
• Continuous improvement: Capture lessons learned, contribute to design standards, templates and automation; mentor engineers and influence productised delivery patterns for SD-WAN/SASE.
• Own solution design: Produce high-quality High-Level and Low-Level Designs for SDWAN, Secure SD-Branch and SASE, integrating NGFW, ZTNA, and Cloud-connect, aligned to customer outcomes and delivery constraints.
• Lead delivery technically: Act as Design Authority across project phases, providing technical governance, standards, and 'go/no-go' on design changes; assure quality of build, test and service transition artefacts.
• Be the trusted advisor: Run customer workshops, translate business drivers into technical decisions, challenge assumptions, and guide stakeholders through risk/benefit trade-offs for transformation programmes.
• Close the loop with pre-sales: Review RFPs/RFIs and proposed architectures, contributing design options, scope assumptions, and delivery estimates that can be sold and delivered on time and within budget.
• Harden security posture: Define and validate SASE/Zero-Trust policies, ZTNA access models, identity-aware segmentation, and secure site templates; align with Nasstar security frameworks and customer policies.
• Operational handover: Ensure designs are operable: documentation, config standards, test plans, knowledge transfer and run-books to transition smoothly into support.
• Continuous improvement: Capture lessons learned, contribute to design standards, templates and automation; mentor engineers and influence productised delivery patterns for SD-WAN/SASE.
Skills, Knowledge and Expertise
Core technical skills
• Fortinet SD-WAN & SASE: FortiGate (physical/VM), FortiManager/FortiAnalyzer, SD-WAN overlays, performance-based routing, segmentation; SASE policy definition; ZTNA (client and gateway).
• Routing & overlays: BGP, OSPF, IPsec, GRE; dual-underlay/dual-hub; DIA/MPLS migrations.
• Firewalling & security: NGFW policies, IDS/IPS, SSL inspection, cert chains and device PKI hygiene; Zero-Trust principles and identity-aware access.
• LAN/WAN & Wi-Fi: Campus/branch designs, SD-Branch, switching/wireless patterns and site standards.
• Cloud & edge: Private DC, interconnect, cloud on-ramps; design guardrails for resilience and failover.
Professional skills
• Customer-centric communicator who can translate business constraints into clear technical decisions and articulate risk/impact in plain English.
• Pragmatic, delivery-minded: balances 'strategic ideal' vs. 'tactical path' to meet timelines and budgets.
• Comfortable chairing design workshops and Design Authority forums, documenting outcomes and holding teams to standards
Nice to have
• Operational Technology (OT) Security: Exposure to OT network segmentation, asset zoning (ISA/IEC 62443 concepts), secure remote access for plant or retail edge, and constrained-environment change practices.
• Broader vendor familiarity (Cisco/Meraki/Juniper) to read/critique designs and handle heterogeneous estates.
Certifications (preferred)
• Fortinet NSE 4–7 (or progress toward).
• Cisco/Juniper routing certs helpful (CCNP, JNCIS/JNCIP).
• Security certs a plus (e.g. CISSP, GIAC) and any exposure to ISA/IEC 62443 for OT.
• Fortinet SD-WAN & SASE: FortiGate (physical/VM), FortiManager/FortiAnalyzer, SD-WAN overlays, performance-based routing, segmentation; SASE policy definition; ZTNA (client and gateway).
• Routing & overlays: BGP, OSPF, IPsec, GRE; dual-underlay/dual-hub; DIA/MPLS migrations.
• Firewalling & security: NGFW policies, IDS/IPS, SSL inspection, cert chains and device PKI hygiene; Zero-Trust principles and identity-aware access.
• LAN/WAN & Wi-Fi: Campus/branch designs, SD-Branch, switching/wireless patterns and site standards.
• Cloud & edge: Private DC, interconnect, cloud on-ramps; design guardrails for resilience and failover.
Professional skills
• Customer-centric communicator who can translate business constraints into clear technical decisions and articulate risk/impact in plain English.
• Pragmatic, delivery-minded: balances 'strategic ideal' vs. 'tactical path' to meet timelines and budgets.
• Comfortable chairing design workshops and Design Authority forums, documenting outcomes and holding teams to standards
Nice to have
• Operational Technology (OT) Security: Exposure to OT network segmentation, asset zoning (ISA/IEC 62443 concepts), secure remote access for plant or retail edge, and constrained-environment change practices.
• Broader vendor familiarity (Cisco/Meraki/Juniper) to read/critique designs and handle heterogeneous estates.
Certifications (preferred)
• Fortinet NSE 4–7 (or progress toward).
• Cisco/Juniper routing certs helpful (CCNP, JNCIS/JNCIP).
• Security certs a plus (e.g. CISSP, GIAC) and any exposure to ISA/IEC 62443 for OT.
Benefits
At Nasstar, we know the importance of looking after our employees – after all, it’s the team that underpins our business!
In addition to a competitive salary, supportive teams, and a real opportunity to progress in your career with a forward-thinking organisation, our benefits package includes:
- 25 days’ holiday (excluding bank holidays) + Your Birthday Off
- Flexible working – it’s important to maintain a work/life balance, as such, we will consider any written request for flexible working
- Virtual working – we practice what we preach and empower our people to work remotely
- Top tech – Leading services and solutions aren’t just for our clients; we supply best-of-breed software and hardware for all our staff too
- 4x annual salary life assurance
- Health cash plan
- Retail discounts and other perks from major brands
There are more than 50,000 engineering jobs:
Subscribe to membership and unlock all jobs
Engineering Jobs
60,000+ jobs from 4,500+ well-funded companies
Updated Daily
New jobs are added every day as companies post them
Refined Search
Use filters like skill, location, etc to narrow results
Become a member
🥳🥳🥳 452 happy customers and counting...
Overall, over 80% of customers chose to renew their subscriptions after the initial sign-up.
To try it out
For active job seekers
For those who are passive looking
Cancel anytime
Frequently Asked Questions
- We prioritize job seekers as our customers, unlike bigger job sites, by charging a small fee to provide them with curated access to the best companies and up-to-date jobs. This focus allows us to deliver a more personalized and effective job search experience.
- We've got over 200,000 jobs from 15,000+ vetted companies. No fake or sleazy jobs here!
- We aggregate jobs from 15,000+ companies' career pages, so you can be sure that you're getting the most up-to-date and relevant jobs.
- We're the only job board *for* software engineers, *by* software engineers… in case you needed a reminder! We add thousands of new jobs daily and offer powerful search filters just for you. 🛠️
- Every single hour! We add 2,000-3,000 new jobs daily, so you'll always have fresh opportunities. 🚀
- Typically, job searches take 3-6 months. EchoJobs helps you spend more time applying and less time hunting. 🎯
- Check daily! We're always updating with new jobs. Set up job alerts for even quicker access. 📅
What Fellow Engineers Say