Firewall Engineer III

RISA; Springfield (VA); On-site; USD 117,000 - 128,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) and Roth

Job summary

RISA is seeking a Palo Alto SME in Springfield, VA to own the Palo Alto estate across PA-3000/5000 hardware, Prisma Access, VM-Series, and Cortex. You will drive secure network architectures, lead hardware refreshes, and manage centralized policy with Panorama.

Required TS/SCI, ability to obtain a polygraph, and 7+ years of hands-on Palo Alto NGFW experience; PCNSE certification and DoD IAT II compliance are essential. On-site role with up to 15% travel.

Qualifications

• Bachelor's degree in a field applicable to the position plus 6 years of relevant experience; equivalents accepted - Master's +4, Associate's +8, or HS diploma +10.
• 7+ years hands‑on administering, configuring, and troubleshooting Palo Alto NGFWs in large‑scale environments.
• Active PCNSE certification.
• DoD 8140.01 and 8570.01-M IAT Level II (e.g. Security+ CE), and CSSP Infrastructure Support within 120 days of start.
• Deep knowledge of PA-3000 and PA-5000 hardware, legacy CLI, troubleshooting, line‑card replacement.
• Prisma Access (SASE), Prisma SD‑WAN, and VM‑Series in AWS, Azure, or GCP.
• Panorama template and device‑group inheritance across a hybrid fleet.
• Advanced BGP, OSPF, IPSec VPN, and NAT.

Responsibilities

• Serve as the lead technical authority for administering and troubleshooting Palo Alto NGFWs.
• Lead the design, analysis, testing, and implementation of secure network architectures on the Palo Alto stack.
• Manage the full hardware and software lifecycle, including refreshes and PAN-OS upgrades on legacy platforms.
• Run Panorama for centralized policy management across a fleet of physical and virtual firewalls.
• Configure master-level security profiles - App-ID, User-ID, Content-ID, SSL Decryption, and WildFire.
• Own configuration management processes and SOPs for all Palo Alto platforms.
• Mentor junior engineers and escalate complex troubleshooting as needed.
• Liaise with contract, customer, and government DAA on network security status, policies, and procedures.

Skills

PCNSE

Palo Alto NGFWs

Prisma Access

VM-Series

Panorama

App-ID

User-ID

Content-ID

SSL Decryption

WildFire

BGP

OSPF

IPSec VPN

NAT

Python

Ansible

Terraform

REST APIs

Education

Bachelor's degree + 6 years relevant experience

Tools

Ansible

Terraform

Palo Alto XML/REST APIs

AWS

Azure

GCP

Job description

Palo Alto Firewall Engineer / SME (PCNSE)

Location: Springfield, VA - on site

Time Type: Full time, Exempt

Clearance Required to Start: Active TS/SCI (U.S. citizenship required)

Additional Requirement: Must be able to obtain and maintain a U.S. Government polygraph

Travel: Up to 15%, local and CONUS

Salary Range: $117,000 – $128,000

Own the Palo Alto estate - legacy iron through Prisma and Panorama.

RISA is hiring a Palo Alto SME to be the focal point for every Palo Alto task, operation, and project on the Network Security Services team supporting an Intelligence Community customer. The work spans both ends of the estate: PA-3000 and PA-5000 hardware refreshes and legacy CLI on one side, Prisma Access, VM-Series, and Cortex on the other. You will talk to the owner here, not a recruiting queue.

What You Will Do

• Serve as the lead technical authority for administering, configuring, and troubleshooting Palo Alto NGFWs across a hybrid enterprise.
• Lead the design, analysis, testing, and implementation of secure network architectures on the Palo Alto stack.
• Manage the full hardware and software lifecycle, including complex refreshes and PAN-OS upgrades on legacy platforms.
• Run Panorama for centralized policy management across a fleet of physical and virtual firewalls.
• Configure master-level security profiles - App-ID, User-ID, Content-ID, SSL Decryption, and WildFire.
• Own configuration management processes and SOPs for all Palo Alto platforms.
• Mentor junior engineers and act as the escalation point for complex troubleshooting.
• Liaise with contract, customer, and government DAA on network security status, policies, and procedures.

What You'll Bring

• U.S. citizenship and an active TS/SCI.
• Ability to successfully obtain and maintain a U.S. Government polygraph.
• Education and experience, per the contract labor category criteria: Bachelor's degree in a field applicable to the position plus 6 years of relevant experience. Equivalents accepted - Master's plus 4, Associate's plus 8, or High School diploma/GED plus 10.
• 7+ years hands‑on administering, configuring, and troubleshooting Palo Alto NGFWs in large‑scale enterprise or global environments.
• Active PCNSE certification.
• DoD 8140.01 and 8570.01-M IAT Level II (e.g. Security+ CE), and CSSP Infrastructure Support within 120 days of start.
• Deep practical knowledge of legacy Gen 2/Gen 3 hardware - PA-3000 and PA-5000 series, legacy CLI, physical troubleshooting, line‑card replacement.
• Prisma Access (SASE), Prisma SD‑WAN, and VM‑Series in AWS, Azure, or GCP.
• Panorama template and device‑group inheritance across a hybrid fleet.
• Advanced BGP, OSPF, IPSec VPN, and NAT.

Nice to Have

• PCNSC or Prisma Certified SASE Professional (PCSAE).
• Python, plus firewall automation with Ansible, Terraform, or the Palo Alto XML/REST APIs.
• Cortex XDR or XSOAR; Expedition for legacy rule migration to App-ID policy.
• Zero Trust Network Access architecture; F5 (APM, AFM), Juniper SRX, or Cisco FTD/ASA.

About RISA

Rolston Information Systems Assurance (RISA) is a Service‑Disabled Veteran‑Owned Small Business that has supported federal defense and intelligence cybersecurity missions for more than seventeen years. We are small on purpose: direct access to leadership, a real say in how the work gets done, and none of the layers that slow large primes down.

Benefits

Medical, dental, and vision insurance; 401(k) and Roth; Paid Time Off; and 11 paid Federal Holidays.

RISA is an Equal Opportunity Employer.