Network Engineer

If you love beauty, you’re in the right place.

As the ultimate curator of over 100 of the most in-demand, highly innovative and boundary-pushing beauty brands, we are the go-to destination for worldwide beauty discovery.

Together through our neighbourhood stores, online presence and loyalty scheme, Space NK has built a flourishing community in which to discover beauty. The customer is at the heart of everything we do, and we will always endeavour to offer everything they need to help them explore, experiment, and enjoy our brands.

Network Engineer | Space NK, London

Reporting to: Platform Engineering Principal

Location: London/hybrid

Department: Technology

Role Overview

The Network Engineer will support, maintain and modernise Space NK’s network services across Microsoft Azure, corporate offices, distribution and datacentre environments, and the retail store estate.

This hands-on engineering role is responsible for the administration and continuous improvement of cloud and on-premises networking, including routing, switching, firewalls, wireless, WAN connectivity and secure hybrid connectivity. The role will help improve network security, operational reliability and Space NK’s transition towards a modern, cloud-enabled network architecture.

Working closely with Platform Engineering, Security, Cloud, Infrastructure, Application and Store Operations teams, the engineer will implement agreed network controls, resolve technical issues and deliver defined areas of project and transformation work. The role will apply automation, robust governance and secure-by-default principles across cloud, corporate, distribution and retail networking.

The successful candidate will have strong foundations in enterprise networking, together with the capability and ambition to develop deeper expertise in Azure networking, hybrid connectivity, security, automation and modern network technologies.

Key Responsibilities

Azure Cloud Networking

· Administer and support Azure Virtual Networks (VNets), subnets, VNet peering and IP addressing.

· Implement and maintain Network Security Groups (NSGs), route tables, User Defined Routes (UDRs) and network segmentation under agreed designs.

· Support Azure Firewall, firewall policies, network rules, application rules and traffic flows.

· Assist with the operation and troubleshooting of Azure VPN Gateway and ExpressRoute connectivity.

· Support Azure networking services including Private Link, Private Endpoints, Load Balancer, Application Gateway and Front Door.

· Use Azure Network Watcher, Azure Monitor, connection diagnostics, flow logs and packet capture to investigate network issues.

· Support the implementation of secure and resilient connectivity between Azure and on-premises environments.

· Maintain Azure network documentation, diagrams, IP addressing and configuration information.

On-Premises Networking

· Administer and support enterprise LAN, WAN, switching, routing and wireless infrastructure.

· Configure and troubleshoot VLANs, trunking, routing, NAT, ACLs, VPNs and network segmentation.

· Support routing technologies including static routing, BGP and OSPF, with opportunities to develop deeper routing knowledge.

· Administer network infrastructure across platforms such as Cisco, Cisco Meraki, SonicWall, Aruba/HPE or equivalent technologies.

· Support firewall operations including rules, NAT policies, VPNs, security zones and high-availability configurations.

· Troubleshoot core network services including DNS, DHCP, NTP and network authentication.

· Use tools such as Wireshark, ping, traceroute, iperf and vendor diagnostics to investigate connectivity and performance issues.

· Support network infrastructure at corporate and distribution locations, including switches, firewalls, wireless access points and WAN connectivity.

Retail Store Networking

· Support Space NK's retail network environment, including Cisco Meraki networking, WAN connectivity, Wi-Fi and store infrastructure.

· Deploy and maintain standard network configurations for new stores, refurbishments and relocations.

· Support SD-WAN, MPLS, Internet and 4G/5G failover connectivity where deployed.

· Troubleshoot store connectivity issues involving tills/POS, payment devices, Wi-Fi, corporate devices and other network-connected services.

· Implement agreed network segmentation between POS, corporate, IoT, CCTV and guest networks.

· Assist with WAN performance and Quality of Service (QoS) requirements for business-critical services.

· Work directly with ISPs, network providers and other suppliers to investigate and resolve service issues.

· Maintain standard configurations, network diagrams and deployment documentation for the store estate.

Hybrid Connectivity & Network Security

· Support connectivity between Azure, corporate locations, distribution environments and retail stores.

· Operate and troubleshoot site-to-site VPNs, ExpressRoute and other private connectivity services.

· Investigate routing, latency, packet loss, MTU and connectivity issues across hybrid environments.

· Implement agreed network segmentation, firewall, ACL and traffic-flow controls.

· Apply least privilege, Zero Trust and secure-by-default principles to network changes.

· Work with Cyber Security to investigate network-related security events and implement agreed remediation.

· Support network controls required for PCI DSS, ISO 27001 and other applicable security and compliance requirements.

Monitoring, Troubleshooting & Automation

· Monitor network availability, performance and capacity using Azure Monitor, SNMP, Syslog, NetFlow and network monitoring platforms.

· Investigate network incidents across cloud, corporate, distribution and retail environments and perform root-cause analysis where appropriate.

· Take responsibility for assigned incidents and technical tasks through investigation, escalation and resolution.

· Engage directly with ISPs, carriers and technology vendors where third-party assistance is required.

· Maintain accurate incident, change and problem records and contribute to technical runbooks and knowledge documentation.

· Use scripting and automation where appropriate, with opportunities to develop skills in PowerShell, Python, Azure CLI, Terraform and APIs.

· Contribute to standardised network configurations and the adoption of Infrastructure/Network-as-Code practices.

Qualifications, Knowledge and Experience

The successful candidate will have a good technical networking foundation and practical experience supporting enterprise network environments.

Relevant experience should include several of the following areas:

· Hands-on experience supporting enterprise LAN/WAN environments.

· Good understanding of TCP/IP, subnetting, VLANs, routing, switching, DNS and DHCP.

· Experience configuring or supporting enterprise switches, routers, firewalls and wireless networks.

· Practical understanding of VPNs, NAT, ACLs and network segmentation.

· Experience with technologies such as Cisco, Cisco Meraki, SonicWall, Aruba/HPE or equivalent platforms.

· Some practical experience with Microsoft Azure networking, or strong traditional networking experience with a desire to develop Azure skills.

· Understanding of VNets, subnets, NSGs, routing and hybrid cloud connectivity.

· Experience troubleshooting network issues using tools such as Wireshark, ping, traceroute and iperf.

· Good understanding of network security principles and secure network configuration.

· Ability to independently investigate and resolve routine network incidents and configuration issues.

· Good technical documentation and communication skills.

Candidates are not expected to be experts in every technology listed. Strong networking foundations, sound judgement and a clear commitment to developing expertise in Azure, hybrid networking, security and automation are essential.

Technical Skills

Experience in any of the following would be advantageous:

· Azure Firewall, VPN Gateway and ExpressRoute.

· Azure Private Link, Private Endpoints, Application Gateway, Load Balancer or Front Door.

· Azure Network Watcher and Azure Monitor.

· Cisco Meraki networking and Dashboard administration.

· SD-WAN or MPLS environments.

· Retail networking, including POS/till connectivity and store Wi-Fi.

· Enterprise firewall technologies such as SonicWall, Palo Alto or Fortinet.

· BGP and OSPF routing.

· Wireless networking and troubleshooting.

· Network monitoring using SNMP, Syslog or NetFlow.

· Automation using PowerShell, Python, Azure CLI, Terraform or APIs.

· Exposure to AWS networking technologies such as VPC, Transit Gateway, Direct Connect or Site-to-Site VPN.

· Experience working within PCI DSS, ISO 27001 or similar controlled environments.

Qualifications & Certifications

A degree in Network Engineering, Computer Science, Information Technology or a related discipline is advantageous but not essential where equivalent practical experience can be demonstrated.

Relevant professional experience in networking, cloud infrastructure or a related engineering role is expected; technical capability, delivery experience and potential are more important than a specific number of years.

Relevant certifications are desirable but not mandatory, including:

· Microsoft Certified: Azure Network Engineer Associate (AZ-700)

· Cisco CCNA

· Cisco Meraki certification or equivalent

· CompTIA Network+

· CompTIA Security+

· Microsoft Azure Fundamentals (AZ-900)

Candidates actively working towards relevant networking or Microsoft Azure certifications are also encouraged to apply.

Skills & Attributes

· Strong interest in networking, cloud technologies and network security.

· Logical and methodical approach to troubleshooting and root-cause analysis.

· Able to take responsibility for assigned technical work while recognising when escalation or guidance is required.

· Willing to perform hands-on investigation, including physical network and cabling checks at Space NK locations where required.

· Comfortable working directly with suppliers and service providers to resolve technical issues.

· Good written and verbal communication skills.

· Collaborative approach when working with Infrastructure, Cloud, Cyber Security, Applications, Service Desk and Store Operations teams.

· Willingness to learn new technologies and develop deeper cloud networking skills.

· Good understanding of change control, documentation and production support.

· Proactive approach to automation and continuous improvement.

Development and Progression

This role provides the opportunity to develop deeper capability across Azure networking, ExpressRoute, SD-WAN, advanced routing, network security, automation and Network-as-Code.

As technical capability and experience grow, the engineer will take increasing responsibility for complex network changes, technical solutions and project delivery, providing a natural development path towards a Senior Network Engineer role.

Please note that only successful candidates will be contacted.

All applicants must have the right to live and work in the UK.

If you want to find out more about us, what it is like to work for us, all about our benefits, and our pledges on Diversity, Inclusion and Belonging, please visit our website.

Space NK are an equal opportunities employer.

How We Will Use Your Information

We will use the information you provide to us with your job application to help us process your application for the specific job you have applied for. If you apply speculatively, we will process your application for the job/relevant business area that you detail within your email.

Please note that our current system does not use an automated filtering system.

All applications made via the website, through a third-party website or in-store will be kept on file for a period of 12 months.

This information will be retained and used to assess your suitability to similar positions that may arise in the future, or if the initial vacancy becomes live again during the 12-month period. If you would prefer us to not hold your information on file/ you wish to be ‘forgotten’ if you are not offered a position with Space NK, please email your ‘right to be forgotten’ to our recruitment email address with RIGHT TO BE FORGOTTEN as the title of the email. We will always inform you when we have deleted your application details, otherwise we will treat your application as consent to us holding this information.