Network Engineer Deployment and Support

About the Job

As 'Network Engineer – Deployment and Support' within our Digital Technology Service Quality team, you will deploy, and support the enterprise network that connects Sanofi — LAN and WAN, WLAN, data center fabric, SD-WAN, and cloud networking across AWS and Azure. You will deploy infrastructure as code using Terraform, Ansible, and Python wherever the platform allows, and apply the same engineering rigor where it does not. You will own what you deploy — from design validation and automated pre-change checks through to day-two operations, capacity management, and incident response — ensuring our network estate remains accurate, performant, resilient, and ready for AI-enabled operations. Ready to get started?

Our Team

Digital Technology – Service Quality is at the heart of Sanofi's digital transformation. We deliver secure, resilient, and scalable infrastructure services that power business-critical applications and enable thousands of users across the enterprise. Our network engineering team owns the connectivity that every other service depends on — spanning offices, laboratories, manufacturing sites, data centers, and multiple cloud providers. Our team combines modern cloud platforms, automation-first engineering, and service excellence to support Sanofi's mission of chasing the miracles of science.

About Sanofi

We're an R&D-driven, AI-powered biopharma company committed to improving people's lives and delivering compelling growth. Our deep understanding of the immune system – and innovative pipeline – enables us to invent medicines and vaccines that treat and protect millions of people around the world. Together, we chase the miracles of science to improve people's lives.

Main Responsibilities

Network Deployment – Infrastructure as Code and Automation

• Deploy cloud network infrastructure as code using Terraform, provisioning virtual networks and VPCs, subnets, route tables, peering, transit gateway and virtual WAN hubs, VPN gateways, and ExpressRoute and Direct Connect attachments across AWS and Azure, with reusable modules, remote state management, and plan review built into the change process

• Deploy and maintain network configuration as code using Ansible, building reusable roles and templates for Cisco IOS and NX-OS, FortiOS, and Junos devices so that every deployment is repeatable, version-controlled, and auditable

• Automate network provisioning and operational tasks in Python, consuming platform APIs — Cisco APIC for ACI fabric, Junos Space for Juniper estate management, Prisma SD-WAN and FatPipe controllers, and F5, Array, and AVI load balancer APIs

• Automate vendor web consoles and portals that expose no usable API using Selenium, so that carrier portals, licensing, and legacy management interfaces do not force manual work

• Use NEXUS as an AI agent within the engineering workflow to accelerate configuration generation and peer review, triage large log and packet-capture data sets, draft runbooks and knowledge articles, and scaffold Ansible and Python automation

• Maintain Git as the source of truth for network configuration, with golden configuration templates, peer-reviewed changes, and a full version-controlled audit trail

• Operate deployment pipelines for network change, including automated pre-change validation, standards compliance checks, and automated post-deployment verification of routing state, reachability, and interface health

• Implement configuration drift detection and automated remediation, so deployed network configuration provably matches its declared intent

• Codify network standards — naming, addressing, VLAN and VRF conventions, hardening baselines, and device software targets — and gate deployments against them

• Drive deployments from an authoritative source of truth for IP addressing and inventory, rather than from spreadsheets

• Implement zero-touch and templated onboarding so new switches, access points, and site routers reach a compliant baseline without manual console configuration

Network Deployment – Engineering Delivery

• Deploy network configuration items (CIs) including Cisco IOS and NX-OS switches and routers, Juniper devices, Aruba wireless controllers and access points, load balancers, and network appliances, from initial requirement through to validated production handover

• Deliver network deployments at offices, laboratories, manufacturing sites, and on-premises data centres, including physical installation, rack and stack, structured cabling, optics, power and environmental checks, and high-availability pairing

• Deliver hardware refresh, end-of-life replacement, and firmware and network OS upgrade campaigns across Cisco IOS/NX-OS, FortiOS, and Junos platforms, including RMA handling across the device estate

• Execute controlled environment promotion (Dev to Pre-Prod to Production) with documented rollback and recovery plans for every deployment

• Register all deployed CIs in the CMDB with correct class, attributes, relationships, ownership, location, and lifecycle status at point of deployment

• Configure and maintain network discovery and SNMP so network CIs are correctly classified with accurate serial numbers, models, and discovery-source behavior

• Onboard every newly deployed CI into monitoring, telemetry, configuration backup, and patching tooling before production sign-off

• Produce and maintain as-built documentation, network topology diagrams, low-level designs, runbooks, and knowledge articles for all deployed infrastructure

Routing, Switching and Networking Protocols

• Implement and support routing across the estate — BGP and OSPF to a strong standard, static routing, route redistribution, filtering, and path selection

• Design and implement VRF-based segregation and route separation across data center, campus, and WAN environments

• Implement and support switching — VLANs, trunking, spanning tree, link aggregation, vPC, and first-hop redundancy on Cisco IOS and NX-OS platforms

• Implement and support IPSec tunnelling for site-to-site and cloud connectivity, including encryption standards, rekeying, and failover behavior

• Design and implement addressing and subnetting to enterprise standards, maintaining IP address management accuracy as deployments land

• Implement quality of service, multicast, and traffic engineering where application or manufacturing requirements demand it

• Implement network zones, VLANs, and segmentation in line with security architecture and zoning standards, in partnership with the network security team

Data Centre, SDN and SD-WAN

• Deploy and support data center fabrics built on Cisco ACI, using Cisco APIC for policy, tenant, and endpoint group configuration, and VXLAN overlays for tenant connectivity

• Deploy and support leaf-spine data center architectures, including fabric expansion, overlay design, and integration with compute and storage connectivity requirements

• Deploy and support SD-WAN across Palo Alto Prisma SD-WAN (CloudGenix) and FatPipe platforms, including overlay design, transport independence, application-aware routing policy, and failover behavior

• Coordinate circuit delivery with carriers and service providers, managing lead times, handover testing, and acceptance

• Monitor and manage WAN capacity, latency, and cost, recommending upgrades, re-homing, or transport changes

Wireless Networking – WLAN

• Deploy, configure, and support Aruba wireless infrastructure, including controllers, access points, and centralized WLAN management

• Deliver wireless design and validation, including predictive design, site surveys, RF tuning, channel and power planning, and post-deployment validation surveys

• Support wireless authentication integration and guest access in partnership with the network security and identity teams

• Troubleshoot wireless performance, roaming, coverage, and interference issues, including in warehouse, laboratory, and manufacturing environments

Core Network Services and Load Balancing

• Deploy and support core network services — DNS, DHCP, IP address management, NTP, and VPN termination points

• Deploy and support load balancing across F5, Array, and AVI platforms, including virtual servers, pools, health monitors, persistence, and SSL offload

• Automate load balancer configuration and application onboarding through platform APIs, so recurring onboarding work is templated rather than hand-built

• Support Zscaler traffic steering from the network side — tunnel and forwarding configuration, proxy routing, and validation of traffic paths to the cloud security platform

• Support application onboarding from a network perspective — connectivity requirements, name resolution, certificates on network and load balancing platforms, firewall rule requests, and traffic flow validation

• Maintain accurate DNS and IP address records as a deployment output rather than an afterthought

Cloud and Hybrid Networking

• Deploy and support network infrastructure across AWS and Azure — landing zone networking, virtual networks and VPCs, subnetting, routing, peering, and transit architectures, provisioned and maintained through Terraform

• Implement and support hybrid connectivity between cloud, data centers, and sites, including ExpressRoute, Direct Connect, and IPSec VPN, with resilient and tested failover paths

• Implement hybrid and split-horizon DNS resolution across on-premises and cloud estates

• Implement and enforce cloud resource tagging standards for network resources, remediating missing or malformed tags to keep network CIs traceable to their application records

• Support container and Kubernetes network connectivity requirements — ingress, egress, service exposure, and IP address planning — in partnership with platform teams

Operational Support, Incident and Problem Management

• Manage Move to Production processes for deployed CIs, ensuring proper handover to operational support teams and that all required GxP documentation is maintained

• Provide L2/L3 operational support for all deployed network CIs, working closely with managed-service partners

• Participate in an on-call rotation, responding to network incidents outside business hours

• Troubleshoot connectivity, latency, packet loss, jitter, and throughput issues using Wireshark and NetScout, in partnership with engineering teams and service providers, driving down mean time to recovery (MTTR)

• Diagnose faults across the network stack — BGP and OSPF convergence and flapping, spanning tree and loop events, duplex and error counters, MTU and fragmentation, asymmetric routing, IPSec tunnel failures, DHCP scope exhaustion, and DNS resolution failures

• Act as technical escalation during Major Incidents, joining technical bridges and providing hands-on recovery and clear technical status updates

• Contribute to Root Cause Analysis for recurring and high-impact issues, raising Problem records and driving corrective and preventive actions to closure

• Maintain high-quality incident resolution notes and knowledge articles to support first-line resolution and data-quality targets

Change and Release Execution

• Raise, plan, and execute network changes with complete risk assessment, implementation plans, test evidence, and rollback procedures

• Represent network changes at the Change Advisory Board (CAB), providing technical justification, impact analysis, and dependency detail drawn from CMDB service topology

• Actively reduce change-induced incidents through peer review, automated validation, staged rollout, and disciplined post-implementation verification

• Schedule and coordinate deployment windows with application, business, and vendor stakeholders to minimize disruption, respecting manufacturing production schedules and site constraints

Observability, Telemetry and AIOps