Palo Alto Firewall Engineer

System One, Inc.; Springfield (VA); On-site; USD 135,000 - 165,000; Part time

Job summary

System One, Inc. is seeking a Palo Alto Firewall Engineer to design, implement, and manage NGFW architectures in a Springfield, VA environment.

The role requires active TS/SCI clearance, 7+ years of hands-on Palo Alto experience, and PCNSE certification. The position is onsite with a contract-to-hire path and offers comprehensive benefits.

Qualifications

• Active TS/SCI clearance required or ability to obtain and maintain.
• 7+ years hands-on Palo Alto NGFW administration in large environments.
• PCNSE certification is required.
• DoD 8140/8570 IAT II compliance (e.g., Security+ CE).
• Ability to obtain CSSP Infrastructure Support certification within 120 days.

Responsibilities

• Lead design, requirements analysis, testing, integration, and implementation of secure network architectures around Palo Alto ecosystems.
• Act as technical authority for configuring and troubleshooting Palo Alto NGFWs across a hybrid environment.
• Engineer changes, assess impacts on transport and security activities, provide sound recommendations.
• Coordinate with project owners, contract leadership, and government customers on security posture.
• Manage lifecycle of Palo Alto hardware/software, including PAN-OS upgrades and line-card replacements.
• Develop and maintain configuration-management processes, network diagrams, docs, and SOPs for Palo Alto platforms.
• Use Panorama for centralized policy management across a diverse firewall fleet.
• Configure App-ID, User-ID, Content-ID, SSL Decryption, WildFire, NAT, IPSec VPNs, threat prevention.
• Oversee incident reporting, investigation, and corrective actions.
• Interface with DAA regarding security status, policies and risks.
• Evaluate new security technologies to improve capacity, performance, and security.
• Mentor junior engineers and serve as escalation point.

Skills

TS/SCI clearance

Palo Alto NGFWs

Network security design

DoD 8140/8570 IAT II

PAN-OS

VM-Series

Education

Bachelor's degree in IT/Cybersecurity/CS

PCNSE certification

DoD 8140/8570 compliance

Tools

Palo Alto NGFWs

PAN-OS

Prisma Access

VM-Series virtual firewalls

Panorama

Job description

Job Title: Palo Alto Firewall Engineer

Location: Springfield, VA

Type: Contract To Hire

Compensation: $80/hr. W2 Benefits available

Conversion Salary: $150,000 annually plus benefits

Work Model: Onsite

Security Clearance: Active TS/SCI clearance and the ability to successfully pass and maintain a U.S. Government polygraph

Responsibilities

• Lead the design, requirements analysis, testing, integration, and implementation of secure network architectures centered on the Palo Alto Networks ecosystem.
• Serve as the lead technical authority for administering, configuring, and troubleshooting Palo Alto Networks Next-Generation Firewalls (NGFWs) across a hybrid enterprise environment.
• Engineer and implement solutions for customer Change Requests (CRQs); assess impacts on enterprise transport and security activities and provide technically sound recommendations.
• Serve as the technical representative for assigned projects and coordinate issues with the appropriate owners, organizations, contract leadership, and customer leadership.
• Manage the full lifecycle of Palo Alto hardware and software, including complex hardware refreshes, PAN-OS upgrades, legacy-platform sustainment, physical troubleshooting, and line-card replacements.
• Develop, oversee, and maintain configuration-management processes, network architecture diagrams, technical documentation, integration and test plans, and Standard Operating Procedures (SOPs) for Palo Alto security platforms.
• Use Panorama for centralized policy management, including templates, device groups, inheritance, and consistent configuration across a diverse fleet of physical and virtual firewalls.
• Configure and maintain advanced security capabilities and profiles, including App-ID, User-ID, Content-ID, SSL Decryption, WildFire, NAT, IPSec VPNs, and threat prevention.
• Oversee security-incident reporting, documentation, investigation, and corrective-action development.
• Act as a liaison to contract/customer management and the government Designated Approving Authority (DAA) regarding network-security status, policies, procedures, and risks.
• Evaluate and report on new and emerging network-security and communications technologies to improve network capacity, performance, reliability, standardization, and security.
• Provide mentorship and technical oversight to junior engineers and serve as an escalation point for complex troubleshooting.
• Follow all customer network-security processes and procedures, maintain compliance with Government and QA standards, and ensure service-performance indicators are met or exceeded.

Requirements

• Security Clearance: Active TS/SCI clearance and the ability to successfully pass and maintain a U.S. Government polygraph.
• A minimum of 7+ years of hands-on experience administering, configuring, and troubleshooting Palo Alto Networks NGFWs in large-scale enterprise/global environments.
• Active Palo Alto Networks Certified Network Security Engineer (PCNSE) certification.
• DoD 8140.01 and DoD 8570.01-M IAT Level II compliance (for example, Security+ CE).
• Ability to obtain and maintain a CSSP Infrastructure Support certification within 120 days of the start date.
• Deep practical knowledge of legacy Gen 2/Gen 3 Palo Alto hardware, including PA-3000 and PA-5000 series platforms, legacy CLI, hardware troubleshooting, and line-card replacements.
• Experience deploying and managing modern PAN-OS architectures, including Prisma Access (SASE), Prisma SD-WAN, and VM-Series virtual firewalls in cloud environments such as AWS, Azure, GCP, or private-cloud.
• Proven expertise with Panorama for centralized policy management, template/device-group inheritance, and configuration deployment across a hybrid firewall fleet.
• Advanced understanding of BGP, OSPF, IPSec VPNs, NAT, TLS/SSL, mutual TLS (mTLS), HTTP, SAML, OAuth, OCSP revocation, DoD PKI, Kerberos, LDAP, and Active Directory.
• Experience with F5 technologies, including APM, AFM, and SSL Orchestrator (SSLO), and troubleshooting TLS/SSL handshake/connection issues.
• Strong network design, engineering, implementation, and troubleshooting skills, including ROM equipment lists and cost estimates.
• Knowledge of DISA and Intelligence Community security standards and requirements.
• Excellent interpersonal skills and technical judgment with the ability to work independently and support weekend/evening work if needed.
• Bachelor’s degree in IT, Cybersecurity, Computer Science, or a related field, with additional relevant experience considered in lieu of a degree.

Desired Qualifications

• Active Palo Alto Networks Certified Network Security Consultant (PCNSC) or Prisma Certified SASE Professional (PCSAE).
• F5 Networks Certified Technology Specialist (CTS).
• Cisco CCNP, CCVP, CCNA, CCDP, or equivalent.
• ITIL v3 Foundations and/or ISC2 CISSP Certification.
• Proficiency in Python and automation tools such as Ansible, Terraform, or Palo Alto XML/REST APIs.
• Hands-on experience with Cortex XDR or Cortex XSOAR.
• Experience with Palo Alto Networks Expedition for migration and rule consolidation.
• Knowledge of Zero Trust Network Access (ZTNA) architectures and additional security platforms (e.g., Juniper SRX, Cisco FTD/ASA).
• Master’s degree in related fields is a plus.

System One, and its subsidiaries including Joulé and Mountain Ltd., are leaders in delivering outsourced services and workforce solutions across North America. We help clients get work done more efficiently and economically, without compromising quality. System One not only serves as a valued partner for our clients, but we offer eligible employees health and welfare benefits coverage options including medical, dental, vision, spending accounts, life insurance, voluntary plans, as well as participation in a 401(k) plan.

System One is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, age, national origin, disability, family care or medical leave status, genetic information, veteran status, marital status, or any other characteristic protected by applicable federal, state, or local law.