L2 Operations Engineer - Network Security

L2 Operations Engineer - Network Security

Level 2 operations role for firewalls, secure web gateway and private access services.

Support level

L2 Operations

Domain

Network Security

Scope

Palo Alto Firewalls, Zscaler, SSE, ZTNA, Enterprise Browser, Internet Security (SWG and FWaaS), and Private Access

Support the clients network security services. Resolve L2 incidents and escalate to L3 when needed.

Process

- End-to-end incident management, from L1/L1.5 escalation to closure.

- Run firewall health checks (CPU and memory) and act on breaches.

- Collect logs and evidence for firewall alert events.

- Troubleshoot reported issues and check network connectivity.

- Enable new access per application needs, through the clients change process.

- Handle port and rule requests from other teams, including server teams.

- Apply firewall patches and OS upgrades under change control.

- Handle outage calls to restore connectivity.

- Support Zscaler and Palo Alto firewalls.

- Protect data in transit and at rest from unauthorised access.

- Report security issues promptly with recommended actions.

- Follow client security standards and guidelines.

- Keep ServiceNow tickets current, with clear resolution and closure notes.

- Join RCA reviews. Update SOPs and knowledge-base articles.

- Work with Connectivity, Hosting, IDAM, DLP and Malware Tools on cross-tower issues.

- Trace policy evaluation in SSE (Zscaler Internet Access, Prisma Access and similar) - URL filtering, Cloud Firewall, SSL inspection, DLP, CASB - and in Prisma Access (security, decryption, URL filtering rules) to find unexpected allows or blocks.

- Diagnose Private Access failures across application segments, segment groups, server groups, access policies and Private Service Edge.

- Troubleshoot forwarding profiles, PAC files, trusted network detection and bypass configuration.

- Diagnose GRE and IPsec tunnel failures to Zscaler, and Remote Network and Service Connection tunnels in Prisma Access, including IKE/IPsec phase issues.

- Resolve DNS issues for private apps, including split DNS, conditional forwarding and DNS search domains.

- Troubleshoot SAML assertion and attribute problems, SCIM provisioning failures and group sync issues with Entra ID, Okta or Ping.

- Resolve device posture and trusted network check failures.

- Take and analyse packet captures (Wireshark, tcpdump, connector-side captures).

- Correlate logs across the SSE platform, SIEM, IdP and endpoint tools.

- Use ZDX and ADEM data to diagnose latency, edge selection and path problems.

Tools

- Palo Alto firewalls (Cloud Firewalls)

- Zscaler

- Palo Alto NGFW, Panorama, Strata Cloud Manager, Strata Logging Service, Prisma Access

- Splunk SIEM

- Datadog

- Enterprise monitoring tools

- ServiceNow

- Okta (secondary skill)

Technologies

- Subject-matter expertise (8+ years) in NGFWs, WAFs, multi-cloud networking and security controls, core networking protocols, and security architecture - primarily Palo Alto, AWS and Azure, with GCP and Alibaba Cloud as a plus.

- Deploying security policies with IPS, URL filtering, DNS security and SSL inspection.

- Firewall security policy tuning with tools such as AlgoSec.

- Quickly identifying and remediating root cause.

- ITaaS, ITIL, monitoring and metrics.

- Multi-cloud networking.

- Firewall administration.

- Secure web gateway.

- Access and rule management.

- Network segmentation.

- Firewall log analysis.

- TCP/IP and routing basics.

- Python or Ansible scripting.

- IaC tooling: GitHub, Octopus, Terraform.

- DNS expertise.

Experience

- 12 years of experience in L2 network security operations

- 24x7 support environment

- Palo Alto firewall administration

- Zscaler administration (scope to be confirmed)

- Enterprise networking expertise

- Firewall rule and port request handling

- Log and evidence collection

- ITSM incident, problem and change processes

- Clear written and spoken English

Certifications

- Palo Alto PCNSA / PCNSE

- Zscaler administrator certification

- CCNA

- A Proxy / SSE industry certification (Zscaler or Palo Alto)