Lead Palo Alto Networks Device Security Engineer

Inizio Partners Corp; New York (NY); Hybrid; USD 120,000 - 160,000; Full time

Job summary

CUNY – Computing and Information Services in New York, NY, seeks a Lead Palo Alto Networks Device Security Engineer (Specialist Level II) for a 12-month contract. Hybrid: 2 days onsite, rest remote; 40 hours/week, 8 AM–5 PM EST.

You will lead end-to-end device security delivery across 25 colleges, including discovery, classification, integrations and governance. The role requires hands-on Palo Alto Device Security implementation, strong integration experience with Cortex XDR/XSOAR, Prisma Access

Qualifications

• Implementation engineering with production device-security project leadership.
• Hands-on configuration of Palo Alto Networks Device Security via Strata Cloud Manager.
• Configuration of PAN-OS, Panorama and NGFWs, with policy validation.
• Integration with Cortex XDR/XSOAR, Prisma Access, SIEM, ITSM and connectors.
• Diagnosis and resolution of discovery, telemetry and API issues.
• Use of APIs, PowerShell, Python, Postman and XQL for data tasks.
• Ownership of schedules, risks, issues and stakeholder communication.
• Documentation of architectures, procedures and KT materials.
• Current Palo Alto Networks or related certifications are a strong plus.

Responsibilities

• Lead hands-on configuration and operationalization of Device Security via Strata Cloud Manager.
• Coordinate device discovery, enrichment, risk assessment and policy recommendations.
• Configure integrations with NGFWs, Panorama, Prisma Access, Cortex XDR, XSOAR, SIEM and ITSM.
• Analyze telemetry, troubleshoot discovery and integration issues, escalate as needed.
• Coordinate with cybersecurity, network, infrastructure and vendor teams across 25 colleges.
• Prepare architecture, configuration, integration and test documentation.
• Provide knowledge transfer and support phased rollout and transition to operations.

Skills

Implementation engineering

Device Security engineering

Palo Alto platform

Integration

Testing & troubleshooting

Automation & data analysis

Technical program delivery

Documentation & knowledge transfer

Certifications

Education

Tools

Strata Cloud Manager

PAN-OS

Panorama

NGFWs

Cortex XDR

Cortex XSOAR

Prisma Access

SIEM

ITSM

PowerShell

Python

Postman

MS Project

Visio

Git

Teams

SharePoint

Wireshark

REST APIs

XQL

Job description

REQUIREMENT SUMMARY

- Role: Lead Palo Alto Networks Device Security Engineer – Specialist Level II

- End Client: CUNY – Computing and Information Services

- Location: 395 Hudson Street, 6th Floor, New York, NY 10014 (Hybrid: minimum 2 days onsite per week, rest remote)

- Positions: 1

- Duration: 12 months

- Anticipated Start: Around November 5, 2026

- Hours: 8 AM – 5 PM EST, 40 hours/week

PROJECT OVERVIEW

CUNY is implementing and operationalizing Palo Alto Networks Device Security across its distributed environment to strengthen device discovery, inventory, visibility, risk assessment, policy development, integration and operational resilience. The engineer will own end-to-end delivery: planning, dependencies, risks, governance, stakeholder coordination, architecture support, platform configuration, device discovery and classification, inventory enrichment, integrations, policy recommendations, testing, troubleshooting, production validation, operational transition and adoption, working with central teams and stakeholders across 25 colleges.

KEY RESPONSIBILITIES

• Lead hands-on configuration and operationalization of Palo Alto Networks Device Security through Strata Cloud Manager
• Coordinate device discovery, classification, inventory enrichment, risk assessment, policy recommendations, segmentation requirements and validation
• Configure and validate integrations with NGFWs, Panorama, Prisma Access, Cortex XDR, Cortex XSOAR, SIEM, ITSM and other authorized systems
• Analyze device and network telemetry; troubleshoot discovery and integration issues; manage resolution and escalation
• Coordinate with cybersecurity, network, infrastructure, operations and vendor teams across 25 colleges
• Prepare architecture, configuration, integration, test, operating-procedure, status, governance and handoff documentation
• Provide knowledge transfer and support phased rollout, production validation, adoption and transition to operations

TECHNICAL ENVIRONMENT

Palo Alto Networks Device Security via Strata Cloud Manager (inventory, Query Builder, policy recommendations, risk assessment), Next-Generation Firewalls, Panorama, PAN-OS, Prisma Access, GlobalProtect, Cortex XDR, Cortex XSOAR, XQL, Device Security APIs and integration connectors, Wireshark, ServiceNow, PowerShell, Python, REST APIs, Postman, MS Project, Visio, Git, Teams, SharePoint.

MANDATORY QUALIFICATIONS

1. Implementation engineering: At least one completed production device-security, IoT/OT-security or network-based asset-discovery implementation as technical lead or primary implementation engineer, with platform, scope, responsibilities, outcome and a client/employer reference.

2. Device Security engineering: Hands-on configuration and operation of Palo Alto Networks Device Security through Strata Cloud Manager, covering device discovery, profiling, classification, inventory enrichment, risk assessment, policy recommendations and production validation.

3. Palo Alto platform: Configuration and troubleshooting of PAN-OS, Panorama and NGFWs, including traffic visibility, device telemetry, policy validation and segmentation support.

4. Integration: Integration with enterprise systems such as Cortex XDR, Cortex XSOAR, Prisma Access, SIEM, ITSM, APIs, connectors or asset-information sources.

5. Testing and troubleshooting: Diagnosis and resolution of discovery gaps, classification errors, telemetry issues, connector failures, API errors, duplicate/inconsistent device records and production-readiness defects.

6. Automation and data analysis: Use of APIs, PowerShell, Python, Postman, XQL, Git or similar for data extraction, integration, validation, reporting or repeatable engineering tasks.

7. Technical program delivery: Ownership of integrated schedules, dependencies, risks, issues, change control, stakeholder coordination, status reporting and decision tracking.

8. Documentation and knowledge transfer: Architecture diagrams, configuration records, integration procedures, test evidence, operating procedures, troubleshooting guides and KT materials produced by the candidate.

9. Certifications (scored, not pass/fail): Current Palo Alto Networks, networking, IoT/OT, security or PM certifications are a strong plus; copies required if claimed.