Senior Cybersecurity Engineer – Network Security, Zero Trust & Automation

As a Senior Cybersecurity Engineer supporting the Zero Trust and Security Engineering team, you will provide senior-level technical expertise for the design, implementation, integration, operation, sustainment, and modernization of enterprise cybersecurity platforms supporting a large, complex federal environment.

Responsibilities

• Provide hands-on engineering for next-generation firewalls, secure remote access, segmentation, and related network-security services.
• Engineer, administer, troubleshoot, optimize, and sustain enterprise firewall technologies. Palo Alto Networks NGFW, PAN-OS, Panorama, Prisma Access, Strata Cloud, or comparable technologies are strongly preferred.
• Manage the firewall policy lifecycle, including rules, objects, NAT, security profiles, recertification, cyber hygiene, optimization, and removal of obsolete or overly permissive policies.
• Lead firewall and security-platform changes, including impact analysis, testing, change control, rollback, validation, and documentation.
• Support Zero Trust and SASE capabilities including ZTNA, Secure Web Gateway, Firewall-as-a-Service, secure remote access, segmentation, device posture, and policy enforcement.
• Troubleshoot complex issues involving routing, NAT, VPN, DNS, authentication, PKI/certificates, TLS/SSL inspection, logging, performance, and high availability.
• Support platform deployments, upgrades, patching, hardening, configuration management, vendor escalation, and platform-specific vulnerability remediation.
• Engineer and support SOAR, security automation, workflow orchestration, and API-based integrations.
• Develop automation for alert enrichment, IOC analysis/blocking, incident triage, ticket creation, containment, remediation, policy changes, and reporting using REST APIs, Python, or comparable technologies.
• Integrate security capabilities and telemetry across SIEM/XDR, endpoint, identity, ITSM, vulnerability management, DLP, NAC, threat intelligence, cloud, and enterprise logging/data platforms.
• Evaluate AI-assisted security operations that improve detection, investigation, response, administration, and analyst workflows while maintaining appropriate human validation and guardrails.
• Support greenfield deployments, migrations, environment separation, coexistence, testing, and transition to operations.
• Collaborate with Security Operations, network engineering, IAM/ICAM, endpoint, NAC, vulnerability management, cloud, and infrastructure teams; serve as a senior technical escalation point as needed.
• Develop architecture diagrams, SOPs, implementation/test plans, runbooks, troubleshooting guides, configuration baselines, and as-built documentation.
• Support security assessments, authorization activities, audits, evidence collection, and compliance requirements.
• Develop and maintain high-quality technical documentation, including architecture and data-flow diagrams, engineering standards, SOPs, implementation plans, test plans, validation procedures, operational runbooks, troubleshooting guides, configuration baselines, and change documentation.
• Ensure security-platform configurations and engineering changes align with applicable organizational cybersecurity policies, technical standards, approved architectures, and change-management requirements.
• May serve as a technical or project lead for assigned initiatives. This position does not require direct personnel-management responsibilities.

In Order to Be Considered

• Bachelor’s degree in Computer Science, Cybersecurity, IT, Engineering, or related STEM discipline and 10+ years of relevant experience; allowable substitutions may apply per contractual labor-category requirements.
• Significant hands-on experience engineering and troubleshooting enterprise next-generation firewalls in complex production environments.
• Strong experience with firewall policy lifecycle management, NAT, zones, segmentation, logging, optimization, and change control.
• Strong network-engineering fundamentals including TCP/IP, routing, BGP, DNS, DHCP, NAT, VPN, TLS/SSL, PKI/certificates, packet analysis, and high availability.
• Experience with Zero Trust/SASE technologies and working knowledge of NIST SP 800-207 or comparable Zero Trust principles.
• Working knowledge of SOAR, security automation, APIs, workflow orchestration, and security-platform integration. Python, REST API, JSON, webhooks, or similar experience is strongly preferred.
• Experience integrating enterprise security platforms and telemetry is strongly preferred.
• Experience with greenfield deployments, migrations, environment separation, or independently managed security environments is strongly preferred.
• Palo Alto Networks or comparable enterprise network-security and SASE experience is strongly preferred, with direct Palo Alto experience highly desirable.
• Federal, government, or highly regulated enterprise experience is preferred.
• Strong analytical, troubleshooting, documentation, communication, and cross-functional collaboration skills.
• Must be able to support planned maintenance and change windows, including occasional after-hours activities, and provide senior technical support for priority incidents or service-impacting security-platform issues when required.
• Must be able to obtain and maintain the required federal suitability determination/background investigation for the position.

Preferred Certifications

• Relevant professional certifications in network security, Zero Trust/SASE, cybersecurity architecture, security automation, cloud security, or network engineering are preferred.