NetSecOps Tech Lead

About the role

The ICRC is looking for an experienced NetSecOps Tech Lead to automate, secure and modernize the network and network security services that connect its data centers, regional hubs and field delegations. The role brings an open-source-first engineering approach to Technology Foundations, covering Infrastructure as Code, GitOps, Kubernetes-based platforms and AI-assisted operations, and acts as the bridge between network engineering, DevOps, security and operations.

Key responsibilities

• Own the network and security automation strategy: IaC (Terraform, Ansible) and GitOps workflows for firewall, ZTNA, SD-WAN, DNS/IPAM and load balancing, delivered through audited pipelines on Azure DevOps.
• Adopt and operate open-source network and security solutions (e.g. OPNsense) and give build-versus-buy advice to the Network team and architects.
• Secure and automate networking for Kubernetes and container platforms (including OpenShift), including CNI, network policies, micro-segmentation, ingress/egress control and certificate lifecycle.
• Build network-as-code foundations: a network source of truth, configuration generation from data models, API-driven integrations and pre-production validation.
• Embed security in automation: policy-as-code, IaC and container scanning, secrets and PKI integration with OpenBao, and SBOM and CVE triage.
• Provide observability with open-source telemetry and monitoring (e.g. Grafana), alerting and dashboards.
• Introduce AI-assisted operations (LLM assistants for configuration review, change-impact analysis, log triage and runbooks) with human approval and strict data protection.
• Bridge the Network, Security, Platform and DevOps teams, contribute to design reviews and provide third-level expertise during business hours; out-of-hours incidents go to the Network team, there is no on-call rota.
• Govern open-source use (license compliance, upstream-first approach, minimal forks) and set coding, testing and documentation standards while mentoring engineers.
• Work with security and compliance teams so configurations meet data-protection policies and audit requirements.

Required profile

• Bachelor's or Master's degree in Computer Science, Engineering or a related field.
• 10+ years in network, DevOps, platform, SRE or security engineering, including at least 3 years in a lead or senior individual-contributor capacity.
• Agile delivery experience; SAFe certification preferred.
• Excellent written and spoken English is a must; French is a plus.
• Location: Geneva, Switzerland; long-term open-ended assignment starting January 2027, 100% activity rate.

Required skills

• IaC and automation: Ansible, Terraform, Python, Git-based workflows and CI/CD pipelines (Azure DevOps).
• Open-source engineering practice, including deployment, patching and upgrading of open-source components.
• Kubernetes and Linux administration, with container security and cluster networking knowledge.
• Solid networking foundations: TCP/IP, DNS, DHCP, BGP, OSPF, VLAN/VXLAN, NAT, VPN, TLS and PKI.
• Network security: firewall policy design, segmentation, zero-trust principles, IDS/IPS and hardening.
• Demonstrated practical use of AI and LLM tools in engineering work.
• Nice to have: Fortinet, SD-WAN or ZTNA, OpenBao, GitOps tooling, network source-of-truth and testing tools, contributions to open source, MCP or agent-based tooling, ITIL and incident management.