Network Security Engineer

Eliassen Group; United States; Remote; Confidential; Full time

Benefits offered by this job

Medical, Dental, Vision benefits

401k with company matching

Life Insurance

Job summary

Eliassen Group is seeking a Network Security Engineer for remote engagement to onboard about 350 Palo Alto firewalls into a Panorama deployment. You’ll work in a two-person team with a locked design and runbook, adhering to scheduled change windows and ensuring precise validation and rollback.

Responsibilities include per-device onboarding, policy migration, and log-forwarding validation. The role requires experience with PAN-OS production-scale deployments and remote collaboration.

Qualifications

• Hands-on PAN-OS at production scale.
• Experience onboarding firewalls to Panorama or similar bulk migration.
• Willing to work evenings/weekends during scheduled windows through Oct–Dec.

Responsibilities

• Run the per-device onboarding sequence: pre-checks, config capture, device group and template assignment, commit, validation, rollback if needed.
• Work in a two-person team against a wave calendar within four-hour change windows.
• Stage and deploy Panorama high-availability pair and log collectors.
• Migrate policy and clean up rulebases across archetypes.
• Configure log forwarding to two destinations and verify logs are received.
• Record devices not matching archetypes to inform next wave.

Skills

PAN-OS

Firewall onboarding

Runbook discipline

Change windows

Rule impact analysis

Tools

Panorama

Job description

Description

Remote

Our client seeks a Network Security Engineer to onboard approximately 350 Palo Alto firewalls into a new Panorama deployment. You will work in a two-person team following a locked design and a defined runbook within scheduled change windows. Devices are transitioning from a third-party managed provider, so precision, validation, and rollback discipline are required. Pairs will execute a repeatable onboarding sequence at pace, identifying exceptions and recording deviations to inform subsequent waves.

We can facilitate w2 and corp-to-corp consultants. For our w2 consultants, we offer a great benefits package that includes Medical, Dental, and Vision benefits, 401k with company matching, and life insurance.

Rate: $95.00 to $115.00/hr. w2

JN -092026-108525

Responsibilities

• Run the per-device onboarding sequence: pre-checks, configuration capture, device group and template assignment, commit, validation, and rollback if validation fails.
• Work in a two-person team against a wave calendar, in scheduled four-hour change windows.
• Stage and deploy the Panorama high-availability pair and its log collectors.
• Migrate policy and clean up rulebases: shadowed rules, unused rules, overly permissive rules, and object consolidation across archetypes.
• Configure log forwarding to two destinations during the parallel-run period, and verify the receiving side actually has the logs.
• Record every device that does not match its archetype to inform the next wave.

Experience Requirements

• Hands-on PAN-OS at production scale: security and NAT policy, security profiles, objects, zones, interfaces, routing, and commit and validation behavior.
• Experience onboarding firewalls to Panorama or comparable bulk device migration to a central management platform.
• Comfort working scheduled evening and weekend change windows through October, November, and early December.
• Discipline with a runbook, following the sequence and escalating rather than improvising during windows.
• Ability to read a firewall configuration and articulate impact if a rule moves.