Network Fraud and Core Security Engineer (m/f/d)

Rakuten Symphony is a Rakuten Group company, providing global B2B services for the mobile telco industry and enabling next-generation, cloud-based, international mobile services.

Building on the technology Rakuten used to launch Japan’s newest mobile network, we are taking our mobile offering global. Let’s build the future of mobile telecommunications together!

About the role

We’re hiring an expert to strengthen our network security posture across telecom signaling and fraud prevention, and to operate our Lawful Interception (LI) capabilities in compliance with applicable regulations. You’ll own day‑to‑day operation, tuning, and evolution of our SS7, Diameter, SIP, and GTP‑C firewalls, help detect and prevent fraud and signaling abuse, and manage LI provisioning and delivery with rigor, privacy, and auditability.

What you’ll do:

• Operate, administer, and optimize signaling firewalls:
  • Diameter security and DRA/Diameter firewall (e.g., S6a, S9, S13, Cx/Dx, Sh)
  • SIP/IMS security (VoLTE/VoWiFi, SBC policy, TLS, topology hiding)
  • GTP‑C firewall (GTPv2‑C on S5/S8/S11; awareness of GTP‑U risks)
  • Build and tune rules, policies, signatures, and machine‑learning/heuristic detections for:
    • Location tracking and subscriber profiling attempts
    • Signaling storms, flooding/DoS, malformed message fuzzing, tunnel hijack
    • Roaming/interconnect threats across SS7/GRX/IPX/S8
  • Lead incident response for signaling and fraud events:
    • Run packet/pcap analysis and protocol call‑flow troubleshooting (Wireshark)
    • Coordinate with NOC/SOC, Core/IMS, Roaming, and Fraud Ops
    • Define and track KPIs, write post‑incident reports, and drive corrective actions
  • Provision, activate, and deactivate LI in accordance with legal warrants/orders
  • Operate and maintain LI mediation and delivery platforms (HI1/HI2/HI3)
  • Ensure data integrity, chain‑of‑custody, logging, and audit‑readiness
  • Liaise with Legal/Compliance and, when required, with LEAs; ensure strict privacy controls
  • Automation and integration:
    • Develop playbooks and automation for rule deployment, testing, and reporting (Python/Bash/REST APIs/Ansible)
  • Architecture and hardening:
    • Advise on security for core/IMS/5G SBA (MME/SGSN/PGW/SMF/AMF/UDM/UDR/NRF/SCP/SEPP)
    • Contribute to roadmap for 5G interconnect security (SEPP, TLS, PRINS), API/SBI protections (HTTP/2, OAuth2/MTLS)
    • Support audits, risk assessments, and compliance initiatives (ISO 27001, GDPR/local privacy)

What you’ll bring:

• 5+ years in telecom core networking or signaling security/fraud prevention
• Diameter: core stack and apps (S6a/S9/S13/Cx/Dx/Sh/Gx/Gy)
• SIP/IMS: SBCs, VoLTE/VoWiFi, IMS call flows, TLS and topology hiding
• GTPv2‑C (and awareness of GTP‑U risks) in EPC/5GC contexts
• Hands‑on with at least one major signaling firewall platform (e.g., Mobileum, Enea/AdaptiveMobile, Positive Technologies, NetNumber/TITAN, Nokia/Oracle/HPE/ERICSSON equivalents)
• Strong pcap/trace analysis and troubleshooting skills (Wireshark, call‑flow tools)
• Experience operating LI platforms (e.g., Verint, SS8, Utimaco, NICE, Ericsson/HPE LI mediation), and working knowledge of:
  • CALEA or relevant local LI regulations
  • Familiarity with GSMA/3GPP security guidance (e.g., GSMA FS.11/FS.19/FS.20, 3GPP TS 33.501 for 5G security)
• Scripting/automation: Python/Bash; exposure to REST APIs, Ansible/Git; basic CI/CD practices
• Solid understanding of core nodes: HLR/HSS/AuC, STP/DRA/DEA, MME/SGSN, PGW/GGSN, PCRF/PCF, SBC/IMS, AMF/SMF/UPF, SEPP
• Excellent written documentation, stakeholder communication, vendor management and cross‑team collaboration
• Willingness to participate in on‑call rotation and pass background checks