Azmath Khan

Security Architecture & Engineering
• Defined network security architecture standards, principles, and reference patterns for cloud and hybrid environments.
• Led security design reviews for network, connectivity, and infrastructure changes using AWS-native and Fortinet controls.
• Produced reusable blueprints, engineering guardrails, and risk recommendations for infrastructure designs.
Cloud Infrastructure Security (AWS)
• Designed secure VPC architecture with public/private subnets, Route Tables, NAT Gateway, Internet Gateway, Security
Groups, and NACLs.
• Implemented IAM-based access control following least privilege principles; enforced MFA and role-based policies.
• Enabled CloudWatch, CloudTrail, GuardDuty, and AWS Security Hub for continuous visibility and threat detection.
• Implemented security controls across cloud infrastructure including identity, network security, encryption, and logging.
Network Segmentation, Firewall & Perimeter Security
• Architected secure segmentation models across enterprise and data centre environments using VLAN strategy, east
west/north-south traffic controls, and NAC policy enforcement.
• Designed and maintained FortiGate firewall policy standards, rule lifecycle governance, and review processes.
• Implemented IDS/IPS, proxy, and SWG preventative controls; engineered ingress, egress, and inter-network filtering
standards.
• Configured F5 BIG-IP LTM for secure load balancing, TLS inspection, certificate handling, and high-availability application
delivery.
DevSecOps, IaC & Automation
• Embedded security into CI/CD pipelines using DevSecOps tooling — SAST, SCA, secrets scanning, and IaC scanning.
• Built and managed secure infrastructure using Terraform, including EC2, VPC, subnets, and Security Groups; used
reusable modules for scalable deployments.
• Secured containerised environments and Kubernetes workloads including runtime and image controls; applied Pod
security policies.
• Automated network security configuration validation, compliance checks, and control assurance — reducing manual effort
by 35%.
Monitoring, SIEM & Incident Response
• Integrated firewalls, IDS/IPS, and load balancers with SIEM/SOC processes; improved network flow visibility and
anomalous traffic detection.
• Developed and improved monitoring and alerting across systems including SIEM detection pipelines and logging
frameworks.
• Contributed to incident response, root cause analysis, and implementation of preventative measures across cloud
environments.
• Defined infrastructure security logging and telemetry requirements across network platforms; enriched network security
events for detection engineering.

NOC Operations & Incident Management
• Continuously monitored network and security infrastructure using SolarWinds NPM/NTA, responding to alerts and
ensuring quick detection and resolution of issues.
• Performed L1/L2 troubleshooting on Switches, Routers, Firewalls, F5 Load Balancers, MPLS links, and WAN circuits;
escalated complex cases following established SLA protocols.
• Categorised and prioritised incidents by severity; maintained timely stakeholder communication and follow-up until
resolution.
• Operated in a 24/7 shift rotation with on-call coverage, ensuring round-the-clock network availability.
Network Engineering & Automation
• Designed and implemented network automation solutions using Python and Ansible, reducing manual configuration time
by 40%.
• Collaborated with network architects to design and deploy MPLS, OSPF, and BGP routing protocols across enterprise
networks.
• Configured and automated test cases on L2 protocols: STP, VLAN; performed feature testing, regression testing, and
debugging on MPLS, BGP, OSPF, and STP.
• Configured VXLAN-EVPN on Fabric Topology using leaf-spine model; all simulation work performed on VM and GNS3
virtualisation platforms.
Documentation & Reporting
• Maintained accurate network topology documentation, configurations, and Standard Operating Procedures (SOPs).
• Generated daily, weekly, and monthly reports on network performance, incidents, and key operational metrics.
• Collaborated with L2/L3 engineers and cross-functional IT teams to resolve complex issues and drive continuous
improvement.

Network Operations & Security Monitoring
• Continuously monitored network and security infrastructure using SolarWinds, responding to alerts and ensuring quick
detection and resolution across service-impacting incidents.
• Supported Telecom IP/MPLS backbone and Internet edge networks, handling service-impacting incidents under strict
SLAs including traffic degradation, outages, and change activities.
• Performed initial troubleshooting on Switches, Routers, Firewalls, Load Balancers, MPLS links, and WAN circuits using
remote tools; documented all incidents and resolutions in the incident management system.
• Leveraged network monitoring tools including SolarWinds to analyse traffic patterns, proactively identify performance
issues, and support capacity planning.
Security & Protocol Engineering
• Worked on telecom network security from a traffic engineering perspective, with exposure to DDoS detection/mitigation
and packet analysis using Wireshark.
• Collaborated with network architects to design and deploy MPLS, VLAN, and STP protocols across enterprise
environments.
• Configured and automated test cases on network infrastructure devices with L2/L3 protocols; documented SOPs and
network topology.
• Categorised and prioritised incidents by severity; provided timely stakeholder updates and collaborated with L2/L3 teams
for escalation resolution.

• Provided after-hours network support on a rotating basis, responding to network-related issues outside standard support
hours.
• Performed regression testing, Python scripting for test case automation, and log verification on MPLS, VLAN, and STP
protocols.
• Used SolarWinds and other monitoring tools to track network health; escalated complex issues to senior engineers with
detailed documentation.
• All simulation and lab work conducted on VM and GNS3 virtualisation environments.