Senior Network Firewall Engineer

Senior Network Firewall Engineer – Palo Alto / VPN Automation

Location: 100% Remote – United States

Duration: Long-term, multiyear project

Team: Network Security / VPN Services

About the Role

We are seeking a Senior Network Firewall Engineer to support a large-scale migration from Cisco AnyConnect to Palo Alto Prisma Access and GlobalProtect.

This hands-on role combines advanced firewall and VPN engineering with Python and/or PowerShell automation. You will help lead the migration, develop reusable tools, and establish scripting standards while remaining directly involved in implementation and troubleshooting.

Responsibilities

• Design, configure, and support Palo Alto Prisma Access and GlobalProtect VPN services.

• Lead phased migrations of users and groups from Cisco AnyConnect to Palo Alto.

• Develop Python and/or PowerShell automation for onboarding, policy configuration, validation, and reporting.

• Automate recurring engineering tasks to improve speed, consistency, and accuracy.

• Establish standards for code quality, testing, documentation, and version control.

• Troubleshoot complex connectivity, authentication, routing, and security policy issues.

• Maintain firewall policies, security profiles, and configuration standards.

• Mentor engineers and review scripts and configurations.

• Create reusable technical documentation, migration runbooks, and operational procedures.

• Collaborate with network, security, identity, and service desk teams and communicate migration progress.

Required Qualifications

• 7+ years of network security or firewall engineering experience.

• Strong hands-on experience with Palo Alto Networks firewalls and GlobalProtect and/or Prisma Access.

• Experience managing Palo Alto environments through Panorama.

• Working knowledge of Cisco AnyConnect or Cisco ASA/FTD VPN environments.

• Proficiency in Python and/or PowerShell, including automation deployed in production.

• Experience using REST APIs to automate network or security platforms.

• Strong knowledge of TCP/IP, routing, NAT, SSL VPN, IPsec VPN, and network security fundamentals.

• Strong troubleshooting, documentation, and communication skills.

• Ability to guide technical work while independently delivering engineering solutions.

Preferred Qualifications

• Palo Alto Networks certification, such as PCNSE.

• Experience with large-scale VPN or remote access migrations.

• Familiarity with SAML, SSO, MFA, Microsoft Entra ID/Azure AD, and Okta.

• Experience with Git, CI/CD, or infrastructure as code.

• Enterprise or managed services experience.

Work Environment

• 100% remote within the United States.

• Long-term, multiyear project.

• Collaborative enterprise network security environment.