Next-Gen Firewall Engineer

Zachary Piper Solutions is seeking a NextGen Firewall Engineer to support our partner, Palo Alto out of Norfolk, VA and Washington, D.C. In this role, you will provide guidance and technical support to clients deploying our security integrations. You'll act as the technical partner, providing strategic guidance around complex systems to secure a digital environment.

The ideal candidate is skilled in implementation work, proactive about resolving potential concerns, and operates well around strict best practices that enable our clients on their road to a more secure digital world.

Overview

• Work full-time at the customer site
• Communicate with the customer(s), sales teams, peers, engineering and support teams as appropriate
• Understand the customer environment, requirements, and security roadmap to implement the appropriate security solution
• Configure, implement, and maintain Security Operating Platform
• Optimize and migrate policies and objects from the existing environment to our Next-Gen Firewall
• Test and validate the migration environment
• Coordinate and execute cutover to production
• Provide guidance on code upgrades
• Facilitate the development of new application and threat signatures
• Interact with our Technical Assistance Center (TAC) to understand and diagnose support cases
• You work with the customer's security & network teams to build confidence across the business units impacted by the change to Palo Alto Networks

Qualifications

• Deep, hands-on experience with Palo Alto Networks hardware (PA-5430) and management platforms (Panorama M-700 or virtual machine). This includes configuration of Panorama (device groups, templates), setting up High Availability (HA), and establishing application-aware security policies (App-ID, Policy Optimizer, NAT, User-ID, File Blocking, Threat Prevention, URL Filtering).
• Ability to lead and execute complex firewall migrations
• Proficiency in integrating the firewalls with critical enterprise systems such as Active Directory/Entra ID for User-ID, and Cisco ISE for identity and access control.
• Expertise in post-implementation tuning, including continuously optimizing threat prevention profiles, eliminating unused objects, consolidating overlapping policies, and performing monthly performance/security checks.
• Minimum of 5 years' experience with network/security solutions and technologies (BGP, SD-WAN concepts, VXLAN and general routing and switching)
• Minimum of 3 years' experience leading security solutions
• Detailed technical experience in the installation, configuration, and operation of high-end firewalls
• Experienced in internetworking, LAN, and WAN technologies
• Certifications: CISSP, CCNA, CNSE, JNCIE-SEC
• Strong verbal communication skills, with demonstrable ability to communicate to senior leaders and technical peers
• BS in Computer Science, MIS, business, or equivalent education/training/experience

Compensation

• $160,000 base, **depending on experience**
• Standard benefits associated with PTO, federal holidays

#LI-AD1

#LI-Onsite

Security integrations, technical support, strategic guidance, digital environment security, client interaction, implementation, best practices, Palo Alto Networks, PA-5430, Panorama M-700, High Availability (HA), App-ID, Policy Optimizer, NAT, User-ID, File Blocking, Threat Prevention, URL Filtering, Next-Gen Firewall, Security Operating Platform, firewall migration, Active Directory, Entra ID, Cisco ISE, identity and access control, BGP, SD-WAN, VXLAN, routing and switching, LAN/WAN, Internet protocols, CISSP, CCNA, CNSE, JNCIE-SEC, post-implementation tuning, threat prevention optimization, policy consolidation, performance checks, documentation, project management, communication skills, client relationship management, problem-solving, high-pressure environment, writing skills