Network Security Lead

Valuelabs; Hyderabad; On-site; INR 1,800,000 - 2,700,000; Full time

Job summary

Valuelabs in Hyderabad is looking for a senior L3 Network Security Lead Engineer to own and design security architectures. The role includes firewall rollouts, migrations to Palo Alto, and multi-site topologies across data center, campus, and cloud.

You will configure and tune L7 security (App-ID, SSL decryption, URL filtering) and CDSS features, while guiding the team and ensuring adherence to security standards.

Qualifications

• Proven end-to-end Palo Alto implementations with documented HLD/LLD.
• Hands-on L7 security: App-ID, SSL decryption, URL filtering and threat prevention tuning.
• Hands-on CDSS: configuration, tuning and troubleshooting of Advanced Threat Prevention, Advanced Wildfire, Advanced URL Filtering and Advanced DNS Security.
• Hands-on Palo Alto firewalls on VM-series (virtual) and PA-series platforms.
• Hands-on Global Protect Always-On VPN design, deployment and troubleshooting.
• Strong grounding in advanced routing, SD-WAN, data center and cloud network architecture.
• Strong troubleshooting at packet, session and policy level.
• Strong documentation and stakeholder communication.

Responsibilities

• Own and produce implementation designs (HLD/LLD) for network security across data center, campus, branch, perimeter and cloud.
• Lead firewall rollouts, migrations to Palo Alto, and PAN-OS upgrades with cutover and rollback plans.
• Architect and deploy Panorama with templates, device groups, log collectors, HA and multi-site topologies.
• Implement and tune L7 security; configure and govern CDSS features.
• Design and implement Global Protect VPNs and site-to-site IPSec VPNs.
• Define network segmentation and Zero Trust on the L7 architecture.
• Act as final escalation point for complex network security incidents; lead RCA and corrective action.
• Set firewall standards and policy frameworks aligned to ISO 27001, PCI-DSS.

Skills

Palo Alto expertise

Network security architecture

L7 security policies

VPN design/troubleshooting

Stakeholder communication

Tools

Panorama

VM-series

PA-series

Terraform

Ansible

Job description

Job Description:

L3 Network Security Lead Engineer

Roles & Responsibilities:

Own and produce implementation designs (HLD/LLD) for network security across data center, campus, branch, perimeter and cloud

• Lead firewall rollouts, migrations from legacy firewalls to Palo Alto, and PAN-OS major upgrades, with cutover and rollback plans
• Architect and deploy Panorama (templates, device groups, log collectors), HA and multi-site topologies hands‑on on both VM-series and physical firewalls
• Design, implement and tune L7 security hands‑on: App‑ID policy model, SSL/TLS decryption, URL filtering, file blocking, data filtering, and anti‑spyware and vulnerability profiles
• Configure, tune and govern CDSS hands‑on: Advanced Threat Prevention, Advanced Wildfire, Advanced URL Filtering, Advanced DNS Security and IoT Security
• Design and implement Global Protect, including Always‑On VPN (pre‑logon and user‑logon), and site‑to‑site IPSec VPN
• Define network segmentation and Zero Trust design on top of the L7 architecture
• Act as final escalation point (L3) for complex network security incidents and performance issues; lead RCA and corrective action
• Set firewall standards, baseline configurations and policy frameworks aligned to compliance (ISO 27001, PCI‑DSS)
• Integrate firewalls with identity (AD, SAML), NAC and SIEM platforms
• Drive automation and IaC (Terraform, Ansible, Panorama APIs)
• Review L2 work, mentor the team, and present designs to stakeholders

Interpersonal Skills Required:

Proven end‑to‑end Palo Alto implementations with documented HLD/LLD

Expert hands‑on L7 security: App‑ID, SSL decryption, URL filtering and threat prevention tuning

Expert hands‑on CDSS: configuration, tuning and troubleshooting of Advanced Threat Prevention, Advanced Wildfire, Advanced URL Filtering and Advanced DNS Security

Hands‑on experience with Palo Alto firewalls on both VM-series (virtual) and physical (PA‑series) platforms

Hands‑on Global Protect Always‑On VPN design, deployment and troubleshooting

Strong grounding in advanced routing, SD‑WAN, data center and cloud network architecture

Strong troubleshooting at packet, session and policy level

Strong documentation and stakeholder communication