Network Security Engineer

Role: Network Security Engineer (Palo Alto SASE/Prisma Access)
Location: Remote
Duration: 12+ months

Overview: We are seeking an experienced Network Security Engineer to support the enterprise deployment, configuration, and optimization of a Palo Alto Networks SASE environment, with a primary focus on Prisma Access. The engineer will work closely with the client's network security team to drive engineering activities, including security policy development, network connectivity, routing, identity integration, and migration from legacy VPN and firewall architectures to a SASE-based model. The target is to roll out Prisma Access across the enterprise by January/February 2027. This is primarily an engineering-focused role, with limited end-user troubleshooting and go-live support expected during the planned Q1 2027 rollout.

Must Have: Prisma Access, Palo Alto SASE, CASB, Strata Cloud Manager, Network Security, IPsec VPN

Key Responsibilities:

• Support enterprise deployment, configuration, and optimization of Palo Alto Prisma Access, including remote networks, mobile users, service connections, IPsec tunnels, and routing.
• Design, implement, and refine security policies, URL filtering, TLS decryption, and threat prevention profiles.
• Configure and optimize CASB/SaaS Security policies to control sanctioned and unsanctioned applications, reduce shadow IT, and protect sensitive data.
• Administer and troubleshoot the SASE environment using Strata Cloud Manager (SCM) and Panorama.
• Support migration from legacy VPN and firewall architectures to Prisma Access, ensuring secure connectivity and minimal disruption.
• Troubleshoot complex networking and security issues involving routing, VPN, DNS, identity-based access, and policy enforcement across hybrid environments.
• Monitor security logs, alerts, and connectivity metrics; perform root cause analysis and implement corrective actions.
• Open, manage, and escalate Palo Alto Networks Technical Assistance Center (TAC) cases, including log collection, technical documentation, severity assessment, and coordination with support engineers.
• Collaborate with network security teams, project stakeholders, and end users during implementation, testing, and go-live activities.
• Participate in planned maintenance windows, change management, and incident response activities.
• Provide limited go-live and hyper-care support during the enterprise rollout.

Required Qualifications:

• Hands-on experience deploying, configuring, and troubleshooting Palo Alto Networks Prisma Access in an enterprise environment.
• Strong understanding of SASE architecture, CASB/SaaS Security, zero-trust principles, and identity-based security.
• Experience with network security policies, routing, IPsec VPNs, DNS, TLS inspection, and hybrid network connectivity.
• Working knowledge of Strata Cloud Manager (SCM) for configuration, monitoring, and troubleshooting.
• Experience managing Palo Alto Networks TAC cases through the customer support portal, including escalation and resolution follow-up.
• Proven ability to troubleshoot complex connectivity, security policy, and application access issues.
• Strong communication, documentation, analytical, and problem-solving skills.
• Ability to work independently while collaborating with client network teams and project management stakeholders.

Preferred Qualifications:

• Experience with Palo Alto Prisma Browser; this is a nice-to-have rather than a core requirement.
• Experience with Panorama for centralized firewall management and policy orchestration.
• Familiarity with Cloud Identity Engine (CIE) and identity provider integrations, including Microsoft Entra ID, Okta, and SAML/Shibboleth.
• Relevant Palo Alto Networks SASE certifications.