Palo Alto Firewall Engineer

System One, Inc.; Springfield (VA); On-site; USD 140,000 - 170,000; Full time

Job summary

System One is seeking an experienced Palo Alto Firewall Engineer to lead design, deployment, and troubleshooting of NGFWs in a large, hybrid enterprise environment in Springfield, VA. The role requires active TS/SCI clearance and hands-on PAN-OS expertise, with onsite work and potential contract-to-hire conversion.

Responsibilities include managing hardware/software lifecycle, CRQ implementation, documentation, and mentorship for junior engineers, with a focus on security, reliability, and

Qualifications

• 7+ years hands-on experience administering, configuring, and troubleshooting Palo Alto NGFWs in large-scale environments.
• Active TS/SCI clearance with ability to pass and maintain a polygraph.
• PCNSE certification.
• DoD 8140.01/8570.01-M IAT II compliance (e.g., Security+ CE).
• Bachelor’s degree in IT, Cybersecurity, CS, or related field.

Responsibilities

• Lead design, requirements analysis, testing, integration, and implementation of secure networks centered on Palo Alto ecosystems.
• Administer, configure, and troubleshoot NGFWs across a hybrid enterprise.
• Engineer changes (CRQs) and assess impacts on security and transport activities.
• Coordinate with project owners, contract leadership, and government customers.
• Manage lifecycle of Palo Alto hardware/software, including PAN-OS upgrades.

Skills

Palo Alto NGFWs

TS/SCI clearance

PAN-OS expertise

Network security design

VPNs (IPSec)

Education

Bachelor's degree in IT/CS

Tools

F5 Technologies

Palo Alto Expedition

Ansible

Terraform

XML/REST APIs

Cortex XSOAR

Job description

Job Title: Palo Alto Firewall Engineer
Location: Springfield, VA
Type: Contract To Hire
Compensation: $80/hr. W2 Benefits available
Conversion Salary: $150,000 annually plus benefits
Work Model: Onsite
Security Clearance: Active TS/SCI clearance and the ability to successfully pass and maintain a U.S. Government polygraph

Responsibilities

• Lead the design, requirements analysis, testing, integration, and implementation of secure network architectures centered on the Palo Alto Networks ecosystem.
• Serve as the lead technical authority for administering, configuring, and troubleshooting Palo Alto Networks Next-Generation Firewalls (NGFWs) across a hybrid enterprise environment.
• Engineer and implement solutions for customer Change Requests (CRQs); assess impacts on enterprise transport and security activities and provide technically sound recommendations.
• Serve as the technical representative for assigned projects and coordinate issues with the appropriate owners, organizations, contract leadership, and customer leadership.
• Manage the full lifecycle of Palo Alto hardware and software, including complex hardware refreshes, PAN-OS upgrades, legacy-platform sustainment, physical troubleshooting, and line-card replacements.
• Develop, oversee, and maintain configuration-management processes, network architecture diagrams, technical documentation, integration and test plans, and Standard Operating Procedures (SOPs) for Palo Alto security platforms.
• Use Panorama for centralized policy management, including templates, device groups, inheritance, and consistent configuration across a diverse fleet of physical and virtual firewalls.
• Configure and maintain advanced security capabilities and profiles, including App-ID, User-ID, Content-ID, SSL Decryption, WildFire, NAT, IPSec VPNs, and threat prevention.
• Oversee security-incident reporting, documentation, investigation, and corrective-action development.
• Act as a liaison to contract/customer management and the government Designated Approving Authority (DAA) regarding network-security status, policies, procedures, and risks.
• Evaluate and report on new and emerging network-security and communications technologies to improve network capacity, performance, reliability, standardization, and security.
• Provide mentorship and technical oversight to junior engineers and serve as an escalation point for complex troubleshooting.
• Follow all customer network-security processes and procedures, maintain compliance with Government and QA standards, and ensure service-performance indicators are met or exceeded.

Requirements

• Security Clearance: Active TS/SCI clearance and the ability to successfully pass and maintain a U.S. Government polygraph.
• A minimum of 7+ years of hands-on experience administering, configuring, and troubleshooting Palo Alto Networks NGFWs in large-scale enterprise/global environments.
• Active Palo Alto Networks Certified Network Security Engineer (PCNSE) certification.
• DoD 8140.01 and DoD 8570.01-M IAT Level II compliance (for example, Security+ CE).
• Ability to obtain and maintain a CSSP Infrastructure Support certification within 120 days of the start date.
• Deep practical knowledge of legacy Gen 2/Gen 3 Palo Alto hardware, including PA-3000 and PA-5000 series platforms, legacy CLI, hardware troubleshooting, and line-card replacements.
• Experience deploying and managing modern PAN-OS architectures, including Prisma Access (SASE), Prisma SD-WAN, and VM-Series virtual firewalls in cloud environments such as AWS, Azure, GCP, or private-cloud.
• Proven expertise with Panorama for centralized policy management, template/device-group inheritance, and configuration deployment across a hybrid firewall fleet.
• Advanced understanding of BGP, OSPF, IPSec VPNs, NAT, TLS/SSL, mutual TLS (mTLS), HTTP, SAML, OAuth, OCSP revocation, DoD PKI, Kerberos, LDAP, and Active Directory.
• Experience with F5 technologies, including APM, AFM, and SSL Orchestrator (SSLO), and troubleshooting TLS/SSL handshake/connection issues.
• Strong network design, engineering, implementation, and troubleshooting skills, including ROM equipment lists and cost estimates.
• Knowledge of DISA and Intelligence Community security standards and requirements.
• Excellent interpersonal skills and technical judgment with the ability to work independently and support weekend/evening work if needed.
• Bachelor’s degree in IT, Cybersecurity, Computer Science, or a related field, with additional relevant experience considered in lieu of a degree.

Desired Qualifications

• Active Palo Alto Networks Certified Network Security Consultant (PCNSC) or Prisma Certified SASE Professional (PCSAE).
• F5 Networks Certified Technology Specialist (CTS).
• Cisco CCNP, CCVP, CCNA, CCDP, or equivalent.
• ITIL v3 Foundations and/or ISC2 CISSP Certification.
• Proficiency in Python and automation tools such as Ansible, Terraform, or Palo Alto XML/REST APIs.
• Hands-on experience with Cortex XDR or Cortex XSOAR.
• Experience with Palo Alto Networks Expedition for migration and rule consolidation.
• Knowledge of Zero Trust Network Access (ZTNA) architectures and additional security platforms (e.g., Juniper SRX, Cisco FTD/ASA).
• Master’s degree in related fields is a plus.

System One, and its subsidiaries including Joulé and Mountain Ltd., are leaders in delivering outsourced services and workforce solutions across North America. We help clients get work done more efficiently and economically, without compromising quality. System One not only serves as a valued partner for our clients, but we offer eligible employees health and welfare benefits coverage options including medical, dental, vision, spending accounts, life insurance, voluntary plans, as well as participation in a 401(k) plan.

System One is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, age, national origin, disability, family care or medical leave status, genetic information, veteran status, marital status, or any other characteristic protected by applicable federal, state, or local law.