Network Security & Hybrid Cloud Engineer

SAMPATH NYAVANANDHI

Network Security Engineer Network Engineer Firewalls • Routing & Switching • Hybrid Cloud

203-***-**** ******************@*****.*** linkedin.com/in/nyavanandhisampath31a47b Open to Remote & Relocation

PROFESSIONAL SUMMARY

Network Security Engineer with 4+ years of enterprise network and security experience in financial services (Vanguard) and IT services (Infosys). Manages Palo Alto (Panorama) and FortiGate next-generation firewalls in high availability, enforces Zero Trust segmentation and least-privilege firewall policy, and troubleshoots GlobalProtect, SSL and site-to-site IPsec VPNs. Supports hybrid cloud connectivity across Azure (ExpressRoute, VPN Gateway, Azure Firewall) and AWS (VPC, Transit Gateway). Strong Cisco routing and switching foundation (BGP, OSPF, VLANs, HSRP/VRRP) from a 24 7 NOC, with Python and REST API network automation. CCNA CompTIA Security+ M.S. Cybersecurity Engineering.

TECHNICAL SKILLS

Network Security: Palo Alto NGFW (PAN-OS, Panorama, App-ID, URL Filtering, Threat Prevention), FortiGate, FortiManager, FortiAnalyzer, Azure Firewall, HA (Active/Passive), IDS/IPS, Zero Trust Segmentation, Least-Privilege Policy, Firewall Rule Audits & Recertification

Routing & Switching: BGP, OSPF, EIGRP, Static Routing, HSRP/VRRP, VLANs, 802.1Q Trunking, STP/RSTP, EtherChannel/LACP, Inter-VLAN Routing/SVIs, ACLs, NAT/PAT, QoS, TCP/IP, IPv4/IPv6, DNS, DHCP, Cisco IOS/IOS-XE

VPN & SD-WAN: GlobalProtect, FortiClient, Site-to-Site IPsec (IKEv1/IKEv2), SSL VPN, FortiGate SD-WAN (Performance SLAs, Link Failover)

Cloud Networking: Azure VNet, VPN Gateway, ExpressRoute, NSGs, UDRs; AWS VPC, Transit Gateway, Security Groups; Cloudflare (DNS, WAF); A10 Load Balancers

NAC, AAA & Wireless: Cisco ISE, 802.1X, MAB, RADIUS, TACACS+, MFA, Cisco WLC, Access Points

Monitoring & SIEM: Microsoft Sentinel (KQL), IBM QRadar, Splunk, SolarWinds, SNMP, NetFlow, Syslog, Wireshark, tcpdump

Automation & IaC: Python, REST APIs, Ansible, Terraform, PowerShell, Bash, Git

Lab & Working Knowledge: Cisco ASAv, F5 BIG-IP (LTM), SASE/ZTNA concepts (Zscaler, Prisma Access)

Process & Frameworks: ServiceNow, ITIL Change Management, NIST CSF, Network Documentation (Visio), Jira, Confluence

PROFESSIONAL EXPERIENCE

AgentsphereAI — Client: Vanguard United States

Network Security Engineer Jun 2026 – Present

•Operate the Fortinet security stack (FortiGate, FortiManager, FortiAnalyzer) across 6 high-availability pairs supporting 10+ sites, managing zone-based policies, NAT and network segmentation in a regulated financial environment.

•Investigate escalated network security incidents using FortiAnalyzer and Microsoft Sentinel; block malicious IPs and domains at the perimeter and drive root cause analysis on 15+ escalations per month.

•Maintain BGP and OSPF routing across multi-site environments, keeping inter-site connectivity stable and aligned with financial-industry security standards.

•Deploy FortiClient remote-access VPN and endpoint security for 500+ users, improving connection stability and reducing VPN-related tickets by 25%.

•Built Python automation using FortiGate and Palo Alto REST APIs to audit firewall rules and objects (unused, duplicate and overly permissive), cutting manual review time from 8 hours to 30 minutes.

Network Security Engineer Intern Jan 2025 – Jun 2026

•Supported FortiGate active-passive HA pairs through FortiManager, including failover testing; ran quarterly rule-base reviews that removed 40+ overly permissive any-any rules to enforce least-privilege access.

•Built Palo Alto App-ID security policies in Panorama with URL Filtering and Threat Prevention profiles for HA firewall pairs.

•Troubleshot GlobalProtect remote-access and site-to-site IPsec VPN issues (IKE phase 1/phase 2 failures, routing problems, MTU/MSS mismatches), resolving 100+ tickets.

•Supported hybrid cloud connectivity: Azure VPN Gateway and ExpressRoute to on-prem, Azure Firewall, NSGs and UDRs, and AWS VPCs connected through Transit Gateway.

•Configured FortiGate SD-WAN rules and performance SLAs to monitor WAN link health and fail traffic over between circuits automatically.

•Implemented VLAN segmentation separating user, server and admin traffic, and enforced RADIUS/TACACS+ AAA with MFA on device management interfaces as part of Zero Trust access controls.

Infosys Ltd. Hyderabad, India

Systems Engineer Sep 2021 – Jan 2024

•Resolved L2/L3 incidents (VLAN/trunk misconfigurations, OSPF adjacency failures, HSRP/VRRP failover, STP loops, DNS/DHCP failures, VPN tunnel drops), closing 60+ ServiceNow tickets per month within SLA.

•Implemented Cisco router and switch changes under ITIL change control (VLANs, trunk/access ports, port-channels, SVIs, HSRP/VRRP, OSPF/BGP, ACLs) with pre/post validation and rollback plans.

•Supported Cisco wireless (WLC, access points) and Cisco ISE, troubleshooting SSID/AP connectivity and 802.1X/MAB authentication failures using RADIUS logs and authorization policies.

•Onboarded firewall, router and switch logs into Microsoft Sentinel and IBM QRadar; authored 150+ KQL queries and correlation rules, reducing false-positive alerts by 30%.

•Automated routine network operations and incident-handling steps with Python and PowerShell, saving 5 hours per week.

Systems Engineer Intern Sep 2020 – Sep 2021

•Provided L1/L2 support for enterprise client LAN/WAN networks (Cisco routers, switches, wireless and firewalls) in a 24 7 NOC rotation.

•Monitored device health, interface utilization and link availability with SolarWinds, SNMP and NetFlow; used Wireshark and tcpdump to isolate latency and connectivity issues.

PROJECTS

Multi-Site Enterprise Bank Network Design Cisco Packet Tracer University of New Haven

•Designed and built a multi-site bank network as a team project: one main branch and three sub-branches connected over a routed WAN.

•Built redundant links between branches with automatic failover, so customers at a failed branch could still reach banking services through another branch.

•Configured inter-VLAN routing to segment departments, plus DHCP and DNS services across all four sites.

University Campus Network Infrastructure Cisco Packet Tracer University of New Haven

•Designed and built a university campus network as a team project: three Cisco 1941 routers linking the dorm blocks, a central server center and the academic and campus facilities buildings, with Cisco 2960 switches at each site.

•Set up a server center with email, DNS and web servers, and gave PCs, laptops and smartphones wired and secured wireless access through access points in the dorms, academic blocks, library and IT consulting areas.

•Put each area on its own subnet with default gateways, configured OSPF between routers, secured routers with console and SSH passwords, and verified end-to-end reachability to the email, DNS and web servers.

Enterprise Network & Security Homelab EVE-NG, OPNsense, Cisco ASAv, Ansible, Terraform, Splunk Sep 2026 – Present

•Built a multi-site enterprise network in EVE-NG with OSPF in the core and BGP at the edge, plus VLAN segmentation, 802.1Q trunking and inter-VLAN routing.

•Deployed OPNsense and Cisco ASAv firewalls with zone-based policies and NAT, and brought up site-to-site IPsec VPNs between sites.

•Automated config backups and VLAN provisioning with Ansible playbooks; used Terraform to build AWS VPC and Transit Gateway test environments.

•Forwarded Syslog and SNMP from lab devices into Splunk, with dashboards and alerts for firewall denies and VPN tunnel flaps.

CERTIFICATIONS

•CompTIA Security+ (SY0-701) — 2026

•Cisco Certified Network Associate (CCNA) — 2026(in progress)

EDUCATION

Master of Science — Cybersecurity Engineering & Networking Jan 2024 – May 2026

University of New Haven, West Haven, CT

Bachelor of Technology — Electronics & Communication Engineering Aug 2021

CMR Institute of Technology, Hyderabad, India

Contact this candidate