Firewall Engineer

TDI (Tetrad Digital Integrity); Arlington (VA); On-site; USD 115,000 - 125,000; Full time

Job summary

Tetrad Digital Integrity (TDI) in the United States is seeking a Firewall Engineer to support the GSM-O II contract. The role requires hands-on experience configuring Palo Alto and Cisco firewalls in virtualized and cloud environments, with a TS/SCI clearance and on-site work in Arlington, VA.

Responsibilities include remediating security gaps, maintaining firewall rules, conducting monthly assessments, and delivering AARs and performance reports to DISA CESO.

Qualifications

• Bachelor's degree in a related field.
• 8+ years of directly relevant experience with firewall engineering.
• 5+ years hands-on Cisco and Palo Alto firewall experience in engineering and operations/maintenance.
• Strong Palo Alto knowledge: Panorama installation, HA config, template stacks, policy push, route config, VPN, AWS VM, IPS.
• Experience in a high-security, TS/SCI environment.
• 8570 IAT Level II Baseline Certification (e.g. CCNA Security, CySA+, GICSP, GSEC, Security+ CE, CND, SSCP).

Responsibilities

• Identify and remediate misconfigurations and security gaps in firewalls and load balancers.
• Provide Tier 3 support to the operations network team.
• Maintain hardware and software components at vendor-supported levels.
• Support mission-critical Continuity of Operations (COOP).
• Conduct monthly firewall assessments and produce improvement reports.
• Create network device performance and traffic utilization reports.
• Develop or participate in After Action Reports (AARs).
• Advise on management of Palo Alto devices within the DISA CESO architecture.
• Collaborate with DISA CESO customer on objectives and roadmaps.
• Identify gaps in current technologies and processes.
• Provide requirements and strategies for future cybersecurity operations.
• Participate in DISA CESO and partner working groups.
• Adhere to DOD STIGs, DISA orders, and JSIG guidelines.

Skills

Palo Alto Firewall

Cisco Firewall

Firewall rules

Network security

Education

Bachelor's degree

Tools

Palo Alto Panorama

AWS

Job description

Tetrad Digital Integrity (TDI) is a leading-edge cybersecurity firm with a mission to safeguard and protect our customersfrom increasing threats and vulnerabilities in this digital age.
TDI is seeking aFirewall Engineerto support the Compartmented Enterprise Services Office (CESO) Task Order for the GIG Service Management – Operations II (GSM-O II) contract. We are looking for a professional with hands‑on engineering and testing experience in virtualized and cloud environments. A skilled engineer knowledgeable and experienced in developing and implementing Firewall/Networking Security Solutions.

With the CESO program, the Defense Information System Agency (DISA) is looking to transform the existing Secure Web Services (SWS) environment, used to provide secure information sharing to the community, into a more mature service offering to meet the DoD and IC community. The goal will be to manage the commercial cloud migration and fully automate the continuous development & continuous integration environment, fourth estate consolidation, professionalize services – ITIL/DevSecOps based processes, improve the customer experience 1st call resolution, and achieve development of a service catalog for Defense Working Capital Fund (DWCF) Model.

This position is onsite 5 days/week in Arlington, VAand requires an active TS/SCI clearance.

RESPONSIBILITIES:

• Identify and remediate misconfigurations, conflicting rules, security gaps, firewall and load balancer security issues, optimize rule‑sets, and enhance the overall security posture and performance of Firewalls and Load Balancers
• Provide Tier 3 support to members of the operations network administrations
• Maintain all HW and SW components at vendor supported levels
• Support mission‑critical Continuity of Operations (COOP)
• Conduct a minimum of two (2) assessment of firewall each month on CESO and customer devices and generate assessment reports and provide recommendations for improvements
• Support the creation of network device performance and traffic utilization monthly reports
• Develop and/or participate in After Action Reports (AARs)
• Provide expert advice and direction regarding the management and operation of all Palo Alto devices in the DISA CESO enterprise architecture
• Interact with the customer point of contact to set objectives/goals based on Palo Alto Networks technologies and available technology roadmap for architecture and design discussions
• Evaluate current technologies and processes associated with DISA CESO to identify gaps.
• Provide requirements and strategies for future cybersecurity operations
• Active participant in meetings with DISA CESO and mission partner working groups
• Adhere to applicable DOD STIGs, DISA applicable orders, and JSIG policy, guidelines, and regulations

QUALIFICATIONS:

• Bachelor's degree and 8+ years of directly relevant experience. Additionall experience may be considered in lieu of degree
• 5+ years of hands‑on Cisco / Palo Alto Firewall experience in both engineering and Operations and maintenance roles
• Strong knowledge of Palo Alto concepts and best practices:
  • Panorama Installation,HA Config, Template and Template Stacks
  • Panorama Policy creation and push to group of Firewalls and Verify Push
  • Palo Alto Route configuration,IPSec Site to Site VPN Config and Troubleshooting
  • Palo Alto VM in AWS,IPS Configuration,Virtual Router / Systems andFirewall HA
• Experience working in a high op‑temp, Top Secret environment
• 8570 IAT Level II Baseline Certification (e.g. CCNA Security, CySA+, GICSP, GSEC, Security+ CE, CND, SSCP)

Tetrad Digital Integrity (TDI) is a leading-edge cybersecurity firm with a mission to safeguard and protect our customersfrom increasing threats and vulnerabilities in this digital age.
TDI is seeking aFirewall Engineerto support the Compartmented Enterprise Services Office (CESO) Task Order for the GIG Service Management – Operations II (GSM‑O II) contract. We are looking for a professional with hands‑on engineering and testing experience in virtualized and cloud environments. A skilled engineer knowledgeable and experienced in developing and implementing Firewall/Networking Security Solutions.

With the CESO program, the Defense Information System Agency (DISA) is looking to transform the existing Secure Web Services (SWS) environment, used to provide secure information sharing to the community, into a more mature service offering to meet the DoD and IC community. The goal will be to manage the commercial cloud migration and fully automate the continuous development & continuous integration environment, fourth estate consolidation, professionalize services – ITIL/DevSecOps based processes, improve the customer experience 1st call resolution, and achieve development of a service catalog for Defense Working Capital Fund (DWCF) Model.

This position is onsite 5 days/week in Arlington, VAand requires an active TS/SCI clearance.

RESPONSIBILITIES:

• Identify and remediate misconfigurations, conflicting rules, security gaps, firewall and load balancer security issues, optimize rule‑sets, and enhance the overall security posture and performance of Firewalls and Load Balancers
• Provide Tier 3 support to members of the operations network administrations
• Maintain all HW and SW components at vendor supported levels
• Support mission‑critical Continuity of Operations (COOP)
• Conduct a minimum of two (2) assessment of firewall each month on CESO and customer devices and generate assessment reports and provide recommendations for improvements
• Support the creation of network device performance and traffic utilization monthly reports
• Develop and/or participate in After Action Reports (AARs)
• Provide expert advice and direction regarding the management and operation of all Palo Alto devices in the DISA CESO enterprise architecture
• Interact with the customer point of contact to set objectives/goals based on Palo Alto Networks technologies and available technology roadmap for architecture and design discussions
• Evaluate current technologies and processes associated with DISA CESO to identify gaps.
• Provide requirements and strategies for future cybersecurity operations
• Active participant in meetings with DISA CESO and mission partner working groups
• Adhere to applicable DOD STIGs, DISA applicable orders, and JSIG policy, guidelines, and regulations

QUALIFICATIONS:

• Bachelor's degree and 8+ years of directly relevant experience. Additionall experience may be considered in lieu of degree
• 5+ years of hands‑on Cisco / Palo Alto Firewall experience in both engineering and Operations and maintenance roles
• Strong knowledge of Palo Alto concepts and best practices:
  • Panorama Installation,HA Config, Template and Template Stacks
  • Panorama Policy creation and push to group of Firewalls and Verify Push
  • Palo Alto Route configuration,IPSec Site to Site VPN Config and Troubleshooting
  • Palo Alto VM in AWS,IPS Configuration,Virtual Router / Systems andFirewall HA
• Experience working in a high op‑temp, Top Secret environment
• 8570 IAT Level II Baseline Certification (e.g. CCNA Security, CySA+, GICSP, GSEC, Security+ CE, CND, SSCP)

PAY RANGE:
$115,000 - $125,000. This range is a good‑faith estimate and not a guarantee of compensation. Final compensation will be based on factors including experience, education, skills, geographic location, internal equity, market data and applicable contract requirements, and may fall outside the posted range.