NetSecOps Tech Lead

About the ICRC

Since 1863, the International Committee of the Red Cross (ICRC) has worked to preserve human dignity and relieve suffering caused by war and armed violence.

In collaboration with our Red Cross and Red Crescent partners around the world, we do everything we can to deliver life-saving aid, reconnect families and locate missing people - helping those who need it most, regardless of who they are and what side of the front line they are on.

We engage with authorities and armed forces on all sides, often confidentially, pressing for access to detainees to improve their living conditions and urging compliance with international humanitarian law to protect non-combatants, including from digital threats.

Purpose of the Role

The ICRC is seeking an experienced NetSecOps Tech Lead to automate, secure and modernize the network and network security services that connect ICRC data centers, regional hubs and field delegations, in support of the ICRC’s mandate of protecting and assisting victims of armed conflict and other situations of violence.

The NetSecOps Tech Lead brings an open-source-first engineering approach to Technology Foundations, covering Infrastructure as Code, GitOps, Kubernetes-based platforms and AI-assisted operations. They are the technical reference for automation and open-source adoption on network and security topics, set engineering standards, and act as the bridge between network engineering, DevOps, security and operations.

Main Duties & Responsibilities

• Own the network and security automation strategy: Infrastructure as Code (Terraform, Ansible) and GitOps workflows covering firewall, ZTNA, SD-WAN, DNS/IPAM and load-balancing configuration, delivered through peer-reviewed, tested and auditable pipelines on Azure DevOps (validation, drift detection, rollback).
• Adopt and operate open-source network and security solutions (e.g. OPNsense) where they are a sound alternative or complement to proprietary products, and provide build-versus-buy, risk and total-cost-of-ownership input to the Network team and the architects.
• Secure and automate networking for Kubernetes and container platforms (including OpenShift): CNI selection and policy, network policies and micro-segmentation, ingress/egress control, service connectivity and certificate lifecycle.
• Build network-as-code foundations: a network source of truth, configuration generation from data models, API-driven integrations with network and security platforms, and pre-production validation.
• Embed security into automation (DevSecOps for network code): policy-as-code, IaC and container scanning, secrets and PKI integration with OpenBao, and SBOM and CVE triage for the open-source components in use.
• Provide observability for network and security services: open-source telemetry and monitoring (e.g. Grafana), alerting integration and actionable dashboards for the Network and Security teams.

.

• Introduce AI-assisted operations responsibly: LLM-based assistants and agents for configuration review, change-impact analysis, log triage and runbook generation, with human approval of changes, full traceability and strict handling of sensitive data in line with ICRC AI and data-protection policies.
• Act as the bridge between the Network, Security, Platform and DevOps teams: contribute to design reviews, translate operational needs into reusable automation modules, and provide third-level expertise during business hours. Out-of-hours incidents are escalated to the Network team; this role has no on-call rota.
• Govern open-source use: ensure license compliance, an upstream-first approach and minimal internal forks, in alignment with the ICRC OSPO on governance and contribution policy.
• Set standards and mentor: define coding, testing and documentation standards for network and security automation, coach engineers, and enable ICT colleagues, including field ICT teams, to use centrally managed automation.
• Collaborate with security and compliance teams to ensure all configurations and toolchains meet ICRC data-protection policies, audit requirements and relevant regulatory frameworks, with particular attention to services supporting the Protection programs.

Education & Professional Background

• Bachelor’s or Master’s degree in Computer Science, Engineering or a related field.
• 10+ years in network, DevOps, platform, SRE or security engineering roles, including at least 3 years in a lead or senior individual-contributor capacity.
• Agile delivery experience; SAFe certification preferred.
• Relevant technical certifications (e.g. Kubernetes, Fortinet) are a plus, not a requirement.
• Experience in a complex and diverse international, multicultural environment is a plus.
• Excellent written and spoken English is a must; French is a plus.

Skills & Competencies

Technical skills (required):

• Strong hands-on automation and IaC experience: Ansible, Terraform, Python, Git-based workflows and CI/CD pipelines (Azure DevOps).
• Proven open-source engineering practice: experience deploying, patching and upgrading open-source components in production, understanding of licensing and supply-chain risks, and experience following or contributing to community projects.
• Knowledge of Kubernetes and Linux administration, with an understanding of container security and cluster networking.
• Solid networking foundations: TCP/IP, DNS, DHCP, BGP, OSPF, VLAN/VXLAN, NAT, VPN, TLS and PKI.
• Network security knowledge: firewall policy design, segmentation, zero-trust principles, IDS/IPS and hardening best practices.
• Demonstrated practical use of AI and LLM tools in engineering work, with awareness of their risks (data leakage, hallucination, prompt injection).

Technical skills (nice to have):

• Experience with Fortinet, SD-WAN or ZTNA implementations.
• Experience with OpenBao and GitOps tooling.
• Experience with network source-of-truth and network testing tools.
• Contributions to open-source projects.
• Experience with MCP or agent-based tooling for operations.
• Knowledge of ITIL practices and incident management frameworks.

Non-technical skills:

• Strong analytical, problem-solving and communication skills.
• Knowledge of data privacy regulations.

Additional Information

• Location: Geneva, Switzerland
• Type of Contract: Open-ended
• Length of Assignment: Long term assignment
• Activity Rate: 100%
• Start date: January 2027
• Recruiter: Alejandra Rodriguez
• Application deadline: Thursday, 19 November 2026
  

Please note that the finalization of this recruitment is subject to the validation of the 2027 PfR.

The ICRC values diversity and is committed to creating an inclusive working environment. We welcome applications from all qualified candidates.

Are you ready to explore the next chapter of your career? Apply now!

For more information about working at ICRC HQ please click here.

Our Values

At the ICRC, we value impact, collaboration, respect, and compassion. We seek candidates who demonstrate behaviors based on these shared values. For more information on the ICRC values, please visit this page.