Network Security Engineer - Palo Alto Gen Firewall; SC Cleared

Network Security Engineer – Palo Alto Next Gen Firewall (SC Cleared)

Mid–level role within the Security Support team responsible for maintaining the availability, security, and operational health of the enterprise network security estate, focusing on firewalls and SASE services.

• Operations & Service Management:
  Support security infrastructure and firewalls following ITIL practices (incident, request, problem, change management).
• Incident & Issue Ownership:
  Methodically triage, diagnose, remediate, and close incidents; escalate with evidence when needed.
• Change Delivery:
  Translate requirements into support actions and execute controlled production changes with peer review, testing, and rollback plans.
• Problem Management:
  Perform root–cause analysis on recurring issues and implement preventative solutions.
• Vendor & Team Coordination:
  Manage technical escalations with vendors, MSPs, and internal cross–functional IT/security teams.
• Documentation & Governance:
  Maintain configurations, asset records, runbooks, and diagrams; apply least–privilege principles and audit compliance in a regulated environment.

• Networking & Protocols:
  Strong knowledge of TCP/IP, DNS, DHCP, NAT, TLS, HTTP/S, static/dynamic routing (BGP, OSPF), VRFs, and segmentation.
• Firewall & Security Administration:
  Hands–on experience with enterprise NGFWs (policy, NAT, VPNs, security profiles) and lifecycle management (upgrades, patching, rule recertification).
• Troubleshooting:
  Advanced diagnosis using PCAPs, logs, and monitoring tools for asymmetric routing, MTU, authentication, and application connectivity issues.
• Preferred Platforms:
  Palo Alto / Fortinet (Panorama, Forti Manager, Forti Analyzer), SASE solutions, and F5 (or equivalent load balancers).
• Desirable: AWS/Azure networking, vulnerability management (Tenable), email security (Mimecast), basic scripting/automation (Python, Power Shell, APIs), and ITIL or vendor certifications (PCNSE, NSE, CCNA/CCNP).

• Shift Rota:
  Coverage between 08:00 and 18:00, with occasional out–of–hours maintenance as required.
• Clearance:
  Security Check (SC) clearance required.