Senior Palo Alto Engineer

OpticoreIT Limited; Greater London; On-site; GBP 85,000 - 120,000; Full time

Job summary

Opticore IT is seeking a Senior Palo Alto Engineer to design and deploy firewalls across new PoP locations, ensuring a clean perimeter ahead of Day 1 for retained and divested entities. The role involves configuring Panorama, implementing SSL decryption, and coordinating with routing and security teams, with 2 days on site in the London area.

You will analyse legacy rulebases, migrate policies to new Panorama groups, and build robust policy rulebases, while maintaining high availability and

Qualifications

• Hands-on experience with Palo Alto devices and Panorama.
• Experience with high-availability (active/active and active/passive).
• Migration and cleanup of complex firewall rulebases.
• Implementation of URL filtering, threat prevention and SSL decryption.
• Ability to create low-level designs and technical papers.

Responsibilities

• Design and deploy Palo Alto firewalls at new PoP locations and integrate with internet edge and core routing.
• Analyse existing firewall rulebases to identify rules per entity.
• Build security policy rulebases for internet egress/ingress and inter-zone traffic, plus NAT policies.
• Implement URL filtering, threat prevention, SSL decryption, and WildFire policies.
• Configure Panorama RBAC, device groups, and templates for separation of entities.
• Migrate retained-entity policies to new Panorama groups and remove divested rules.
• Deploy firewalls in HA pairs and validate failover under test conditions.
• Coordinate with routing, GRE tunnel termination, and firewall-as-code initiatives.
• Produce low-level designs and decision records; participate in design reviews.

Skills

Palo Alto devices

Panorama

Device groups & templates

Application-based policy

User-ID / Content-ID

NAT policies

Log forwarding to SIEM

HA clustering

Tools

GlobalProtect VPN

GRE tunnels

IPSec

Job description

Opticore IT are currently searching for a Senior Palo Alto Engineer to deliver perimeter security infrastructure and firewall policy separation across new PoP locations and existing infrastructure as part of a corporate divestiture programme, ensuring a clean perimeter security posture for both retained and divested entities ahead of Day 1. This opportunity will be joining a Broadcast Media client based in the London area with 2 days a week on site.

Opticore IT is a specialist Network Engineer and Project Management consultancy offering a wide variety of opportunities to work within fast-paced,challenging environments across our client base spanning multiple sectors including Finance, Broadcast Media, Telecommunications and more.

What you'll be doing:

• Design and deploy Palo Alto firewalls at new PoP locations, configuring security zones, interfaces, and routing integration with internet edge and core routing

• Analyse existing firewall rulebase to identify rules belonging to each entity.

• Build security policy rulebase covering internet egress/ingress, inter-zone, and partner connectivity, plus NAT policies for internet-facing services

• Implement URL filtering, threat prevention, anti-spyware, file blocking, WildFire integration, and SSL decryption policies

• Configure Panorama device groups, template stacks, and RBAC to enforce entity administrative separation, and manage shared and device-group-specific policy rules

• Analyse existing firewall rulebase, migrate retained-entity policies to new Panorama device groups, and remove retained-entity rules, address objects, and service objects from divested-entity firewalls

• Deploy firewalls in active/passive or active/active HA pairs at PoP locations and validate failover behaviour under test conditions

• Configure third-party, partner, and inter-PoP firewall policy including DMZ and partner zones for controlled external access

• Reconfigure Panorama RBAC to restrict divested admin access to divested device groups only and validate divested-entity perimeter is clean for Day 1

• Coordinate with the core routing team on internet edge and PoP integration, the Zscaler engineer on GRE tunnel termination, and the automation team on firewall-as-code approaches

• Produce low-level designs, technical working papers, and decision records, and participate in design assurance reviews

What you'llbring:

• Deep hands-on experience with PA-3200/5200/400 or VM-Series and Panorama (device groups, templates, template stacks). Application-based policy, User-ID, Content-ID. NAT (source, destination, bi-directional). Log forwarding to SIEM.

• Zone-based firewall architecture and micro-segmentation principles. Active/passive and active/active HA including session synchronisation and failover thresholds.

• Analysing and rationalising complex legacy rulebases. Migration/cutover plans with rollback. Rule auditing, cleanup, and optimisation. GlobalProtect VPN configuration where required.

• Full threat prevention suite (antivirus, anti-spyware, vulnerability protection, URL filtering, WildFire). SSL/TLS decryption (forward proxy, inbound inspection) and certificate management.

• Strong TCP/IP, stateful inspection, and packet flow through firewalls. IPSec/IKEv2/GRE for site-to-site VPN. Routing integration with firewalls (BGP, OSPF, static, PBF).

Diversity:

At Opticore IT we embrace diversity and are committed to equal opportunities. We actively recruit for an inclusive and diverse workforce and as such, want to ensure we do everything we can to support your application.

We want you to feel empowered to let us know if you require any adjustments to be made with your application or interview process so please speak to our recruitment team.
#LI-NH1