Firewall Engineer

: L2 Network Firewall & WAF Engineer

Role Overview

The L2 Network Firewall & WAF Engineer is responsible for monitoring, troubleshooting, and maintaining enterprise firewall and Web Application Firewall (WAF) infrastructure. This role focuses on incident resolution, rule management, and ensuring network security availability and performance.

Key Responsibilities

Firewall Management

• Monitor and manage firewalls (e.g., Palo Alto, Fortinet, Cisco ASA, Check Point)
• Implement, modify, and review firewall rules as per security policies
• Troubleshoot network connectivity issues related to firewall configurations
• Perform log analysis to detect anomalies and security incidents
• Ensure high availability (HA), failover, and redundancy health

WAF (Web Application Firewall) Operations

• Manage WAF tools (e.g., F5 ASM/AWAF, Imperva, Akamai, AWS WAF)
• Analyze web traffic and tune WAF policies to reduce false positives/negatives
• Investigate and mitigate application-layer attacks (SQL injection, XSS, etc.)
• Apply security signatures and updates

Incident & Ticket Management

• Handle L2 support tickets and escalations from L1 team
• Perform root cause analysis (RCA) for incidents
• Provide timely resolution within SLA
• Collaborate with L3 teams for complex issues

Security Monitoring

• Monitor security alerts from SIEM tools (Splunk, QRadar, etc.)
• Identify suspicious activities and respond to threats
• Assist in vulnerability remediation efforts

Change & Configuration Management

• Execute network/security changes as per change management process
• Maintain proper documentation of firewall & WAF rules
• Ensure compliance with security standards and audit requirements

Required Skills

Technical Skills

• Strong knowledge of: 
• TCP/IP, DNS, HTTP/HTTPS, SSL/TLS
• Network security concepts (NAT, VPN, IPS/IDS)
• Hands-on experience with: 
• Firewalls: Palo Alto / Fortinet / Cisco ASA / Check Point
• WAF: F5 ASM/AWAF / Imperva / Cloudflare / AWS WAF
• Basic understanding of: 
• Load balancers (F5, NGINX)
• SIEM tools and log analysis
• Familiarity with Linux/Unix basics

Tools & Technologies

• Firewall management consoles
• Packet capture tools (Wireshark, tcpdump)
• Ticketing tools (ServiceNow, Jira)

Experience Required

• 25 years experience in network/security operations
• Experience in L2 support environment (incident handling & troubleshooting)
• Exposure to production environments and change management

Preferred Certifications

• CCNA / CCNP Security
• Palo Alto PCNSE / Fortinet NSE
• CEH / CompTIA Security+

Key KPIs

• SLA adherence for incident resolution
• Change success rate
• Reduction in false positives (WAF tuning)
• Security incident response time