Network Security Consultant Palo Alto Networks / Azure - Remote

Network Security Consultant Palo Alto Networks / Azure - Remote

• Start September 2026 - 6 month assignment with potential to extend
• Work Authorization - or - no 3rd Party Inquiries please

Role Summary

We are looking for an experienced Network Security Consultant to support an enterprise network built on Palo Alto Networks security infrastructure integrated with Microsoft Azure, covering corporate headquarters and remote offices across the US, EU, and Asia. The consultant will act as the technical authority for firewall architecture, secure connectivity, and cloud network design across globally distributed sites.

Key Responsibilities

• Design, implement, and maintain Palo Alto Networks NGFW (physical and VM-Series) infrastructure across on-premises and Azure environments.
• Plan and manage site-to-site VPN and dynamic routing (BGP/OSPF) between regional offices, data centers, and Azure VNets.
• Configure and maintain GlobalProtect for secure remote-user access, including client IP pool management and route redistribution into BGP/OSPF.
• Design and administer Azure networking components: VNets, VNet peering, ExpressRoute, Azure VPN Gateway, Route Tables (UDRs), NSGs, and Azure Firewall where applicable.
• Develop and maintain multi-region connectivity architecture (hub-and-spoke or mesh) linking US, EU, and Asia offices with consistent security policy and low-latency routing.
• Administer centralized policy and logging through Panorama, maintaining a consistent security posture across all sites.
• Lead routing design and troubleshooting for BGP peering between Palo Alto virtual routers and Azure/ExpressRoute circuits or third-party carriers.
• Support network segmentation, Zero Trust principles, and security zone architecture across cloud and branch environments.
• Resolve cross-region connectivity, latency, and routing issues in coordination with regional IT/network teams and ISPs.
• Create and maintain network architecture documentation, runbooks, and change management records.
• Contribute to security audits, vulnerability remediation, and compliance initiatives (e.g., SOC 2, ISO 27001, GDPR considerations for EU sites).

Preferred Certifications

• PCNSE (Palo Alto Networks Certified Network Security Engineer)
• Microsoft Certified: Azure Network Engineer Associate (or equivalent Azure networking certification)
• CCNP / JNCIP or equivalent routing/switching certification (Juniper experience a plus)

Required Qualifications

• At least 5 years of hands-on experience with Palo Alto Networks firewalls (PAN-OS), including Panorama management.
• Strong practical knowledge of GlobalProtect architecture (portal/gateway design, IP pools, split tunneling, redistribution).
• Solid knowledge of dynamic routing protocols, particularly BGP (route redistribution, filtering, multi-homed peering); OSPF is a plus.
• Proven experience with Microsoft Azure networking: VNets, ExpressRoute, VPN Gateway, NSGs, Route Tables, Azure Firewall/Front Door (as applicable).
• Experience designing and maintaining multi-region WAN/VPN architectures that connect offices across multiple continents.
• Knowledge of SD-WAN concepts and technologies is a plus.
• Practical knowledge of IPSec VPN design, GRE tunnels, and Transit-style hub-and-spoke topologies.
• Experience supporting distributed teams across US, EU, and Asia time zones.
• Strong troubleshooting abilities using CLI (PAN-OS), packet captures, and routing table analysis.
• Excellent documentation and stakeholder communication abilities.

Additional Information

• All candidates are encouraged to apply, but many positions require a strict drug and background check by our customers.
• F2OnSite supports and adheres to all state laws regarding background checks.