Network Security Engineer

Role & responsibilities

Senior network security engineer responsible for firewall and Secure Service Edge implementation, migration, policy transformation and production cutover across Palo Alto Networks, Fortinet and Cisco technologies.

Key Responsibilities / Implementation Scope

• Design, configure, migrate and troubleshoot enterprise firewall services across Palo Alto Networks, Fortinet and Cisco firewall platforms.
• Implement and support Palo Alto Networks NGFW platforms including PA-5450 and PA-3220, with security zones, interfaces, routing, NAT, security policy and threat-prevention profiles.
• Configure and operate Panorama for centralized policy, object, template/device-group and firewall management.
• Support Fortinet FortiGate firewalls, including OT firewall requirements and industrial/segmented network use cases where applicable.
• Support legacy Cisco ASA and Cisco Firepower / Secure Firewall environments during migration and replacement activities, including VPN appliance functions where present.
• Support Palo Alto SSE / Prisma Access / GlobalProtect components where required for remote-user and secure-access connectivity.
• Build and migrate firewall policies, NAT/PAT rules, objects, zones, security profiles and network-segmentation controls.
• Configure and troubleshoot site-to-site IPsec VPNs, remote-access dependencies, routing through firewalls and failover/high-availability behavior.
• Perform rule-base analysis, cleanup, optimization and validation while maintaining business connectivity and change-control requirements.
• Troubleshoot application flows using session/browser tools, packet captures, firewall logs and routing/NAT analysis.
• Execute firewall cutovers/migrations with pre-checks, validation, rollback support, issue resolution and hypercare.
• Prepare implementation runbooks, policy migration workbooks, test scripts, rollback plans and as-built documentation.

Required Technical Skills

Area

Required Hands-on Experience

Palo Alto NGFW

PA-5450, PA-3220, PAN-OS, zones, interfaces, routing, NAT, security policy, App-ID, threat prevention and SSL/TLS inspection.

Panorama

Centralized firewall management, device groups, templates/template stacks, shared objects, policy deployment and operational troubleshooting.

Palo Alto SSE / Remote Access

Palo Alto SSE, Prisma Access and GlobalProtect architecture/operations where in scope.

Fortinet

FortiGate policy, routing, NAT, VPN, segmentation and OT firewall use cases.

Cisco Firewall

Cisco ASA and Cisco Firepower / Secure Firewall; legacy support, migration and VPN appliance functions.

VPN / Segmentation

IPsec VPN, remote-access dependencies, network segmentation, zone-based policy and high-availability/failover concepts.

Troubleshooting / Migration

Session analysis, logs, packet capture, NAT/routing analysis, rule-base cleanup, cross-vendor firewall migration and production cutover.

Certification Requirements

Mandatory: At least one relevant firewall/network-security certification is required (for example PCNSE, Cisco CCNP Security, or an appropriate current Fortinet professional-level credential).

Preferred / Advantageous: Additional Palo Alto, Cisco Secure Firewall/Firepower or Fortinet specialist certifications and multi-vendor firewall migration experience.

Required Deliverables

• Firewall policy/NAT/object migration workbook
• Implementation runbooks and MOPs
• Firewall/SSE cutover and rollback plans
• Connectivity, security-policy and failover test scripts
• As-built configuration, rule-base documentation and operational handover

Preferred candidate profile