JOB TITLE: Palo Alto Networks Security Engineer – Expert Level Consultant
JOB OVERVIEW
Location: San Francisco, CA
Experience: 10+ years
Duration: Estimated 2 years [NO BENEFITS]
JOB SUMMARY: A large organization is modernizing its network security infrastructure as part of a next-generation network program. The initiative includes deploying a 400Gbps network backbone to improve network capacity, reliability, cybersecurity and operational resilience.
This role is for an expert-level Palo Alto Networks Security Engineer Consultant to support the assessment, architecture validation, migration, implementation and optimization of the Next Generation Firewall (NGFW) environment. The consultant evaluates existing and proposed Palo Alto Networks security architectures, implements firewall migration strategies, optimizes security policies, configures centralized monitoring and reporting, and ensures operational readiness.
The consultant works closely with network engineering, cybersecurity, infrastructure and project stakeholders to make sure the deployment aligns with technical architecture standards and cybersecurity objectives.
RESPONSIBILITIES
Palo Alto Networks Security Assessment
- Conduct comprehensive assessments of existing and proposed Palo Alto Networks security architectures.
- Evaluate NGFW configurations, Panorama management, security policies, security profiles and threat-prevention capabilities.
- Review Advanced Threat Prevention (ATP) configurations and validate alignment with Palo Alto Networks best practices.
- Assess firewall interfaces, security zones, routing, system configurations and high-availability architecture.
- Identify security gaps, configuration deficiencies, vulnerabilities and operational risks.
- Develop prioritized remediation plans and provide documented recommendations.
Next Generation Firewall Migration and Deployment
- Develop migration strategies and implementation plans for the NGFW environment.
- Perform firewall configuration cleanup and prepare existing environments for migration.
- Configure Palo Alto Networks firewalls, Panorama, security services and associated components.
- Migrate existing firewall configurations, policies, rules and security profiles into the new environment.
- Implement network segmentation, security zones, routing rules and firewall policies.
- Configure high-availability architecture and conduct failover validation.
- Develop and execute functional, operational, connectivity, performance and failover testing.
- Support production deployment, migration cutovers and after-hours implementation activities when required.
- Troubleshoot and resolve migration-related technical issues.
- Maintain project status reports, risk logs, issue tracking and change-management documentation.
Security Optimization and Best Practices
- Implement Palo Alto Networks security best practices and recommended architecture improvements.
- Optimize security policies, security profiles and threat-prevention configurations.
- Design and configure centralized monitoring, dashboards, alerting and reporting using Panorama and applicable native Palo Alto Networks tools.
- Use Strata Cloud Manager and Strata Logging Service where applicable and licensed.
- Configure weekly and monthly security reporting, operational metrics and historical performance trending.
- Provide technical advisory services and troubleshooting support.
- Identify opportunities to improve network visibility, security posture, operational efficiency and system stability.
- Coordinate technical escalations and support ticket submissions with Palo Alto Networks when required.
Documentation and Knowledge Transfer
- Develop and maintain comprehensive technical and implementation documentation.
- Prepare final as-built architecture and configuration documentation.
- Document standard operating procedures, firewall administration processes, and monitoring and troubleshooting procedures.
- Conduct structured knowledge-transfer sessions for designated network engineering and operations personnel.
- Prepare training materials and documentation to support long-term operational readiness.
MINIMUM QUALIFICATIONS
Candidates must demonstrate the following experience through specific, verifiable client project engagements:
- Minimum 10 years of expert-level, hands-on experience with Palo Alto Networks technologies in large-scale enterprise environments, including NGFW architecture, implementation, configuration, migration, Panorama and operational support.
- Minimum 10 years of experience conducting enterprise cybersecurity assessments, including firewall architecture reviews, security policy evaluations, threat-prevention assessments, vulnerability identification, risk analysis and remediation recommendations.
- Proven experience planning and executing large-scale firewall migrations involving at least 5 pairs (10 total) of firewalls within a single program or project. This includes configuration cleanup, policy migration, failover testing, validation, troubleshooting and production cutovers.
- Minimum 10 years of experience implementing Palo Alto Networks vendor-recommended and industry-recognized security best practices, including centralized monitoring, alerting, dashboards, reporting and trending using native tools.
- Minimum 10 years of experience developing enterprise network security documentation, as-built deliverables and operational procedures, and conducting technical knowledge-transfer and training sessions.
- Minimum 3 years of experience with advanced Palo Alto Networks security services and solutions, including:
- Advanced Threat Prevention (ATP)
- Prisma Access
- Prisma Cloud
- Associated security management and reporting capabilities
REQUIRED PLATFORM EXPERIENCE
- Palo Alto Networks PA-7500, PA-5450, PA-3000 series or equivalent platforms.
- Panorama centralized management.
- Next Generation Firewalls (NGFW).
- High availability (HA) and failover configurations.
- Multi-zone firewall environments with 1,000+ policies.
- High-traffic firewall environments exceeding 10Gbps throughput.
- Prisma Access and SASE deployments.
- Advanced Threat Prevention.
- Strata Cloud Manager and Strata Logging Service, where applicable.
ADDITIONAL REQUIREMENTS
- Experience in enterprise environments covering at least 5 physical locations and 20,000+ users.
- Strong experience in complex network security architecture and migration programs.
- Ability to provide verifiable end-client project references.
- Strong technical documentation, communication, troubleshooting and stakeholder coordination skills.
- Availability to support after-hours firewall migration cutovers when required.
