Palo Alto Networks Security Engineer – Expert Level

Navitas Partners, LLC; San Francisco (CA); On-site; USD 150,000 - 190,000; Full time

Job summary

Navitas Partners, LLC is seeking a Palo Alto Networks Security Engineer at an expert level in the San Francisco Bay Area. The role focuses on assessing security architectures, migrating to Next Generation Firewalls, and optimizing threat-prevention configurations.

You will configure Palo Alto devices, Panorama, and related security services while coordinating complex migrations. The ideal candidate brings a minimum of 10 years of hands‑on experience with Palo Alto Networks technologies in large

Qualifications

• Minimum 10 years of expert‑level hands‑on experience with Palo Alto Networks technologies in large enterprise environments.
• Minimum 10 years of experience conducting enterprise cybersecurity assessments, including firewall architecture reviews, policy evaluations, threat‑prevention assessments, vulnerability identification, risk analysis, and remediation.
• Proven experience planning and executing large‑scale firewall migrations involving multiple firewalls in a program or project.
• Minimum 10 years of experience implementing security best practices and centralized monitoring, alerting, dashboards and reporting.
• Minimum 3 years of experience with ATP, Prisma Access, Prisma Cloud and related security services.

Responsibilities

• Conduct comprehensive assessments of existing and proposed Palo Alto Networks security architectures.
• Evaluate NGFW configurations, Panorama management, security policies, and threat-prevention capabilities.
• Review ATP configurations and validate alignment with best practices.
• Assess firewall interfaces, security zones, routing, and high-availability architecture.
• Identify gaps, vulnerabilities, and operational risks; develop remediation plans and document recommendations.
• Develop migration strategies and implementation plans for NGFW environments; perform configuration cleanup and cutsovers.
• Configure firewalls, Panorama, security services, policies, and migrate configurations to NGFW.
• Implement network segmentation, routing rules, and HA; develop testing and validation plans.
• Provide technical advisory services, troubleshooting, and post‑migration support.
• Develop and maintain documentation; conduct knowledge-transfer sessions; prepare training materials.

Skills

Palo Alto Networks

NGFW architecture

Panorama

Threat prevention

Security assessments

Firewall migrations

Prisma Access

Prisma Cloud

Strata Cloud Manager

Strata Logging Service

Tools

Panorama

Strata Cloud Manager

Strata Logging Service

Prisma Access

Prisma Cloud

Job description

Job Title: Palo Alto Networks Security Engineer – Expert Level

Roles and Responsibilities

1. Palo Alto Networks Security Assessment

• Conduct comprehensive assessments of existing and proposed Palo Alto Networks security architectures.
• Evaluate Next Generation Firewall configurations, Panorama management, security policies, security profiles, and threat-prevention capabilities.
• Review Advanced Threat Prevention (ATP) configurations and validate alignment with Palo Alto Networks best practices.
• Assess firewall interfaces, security zones, routing, system configurations, and high-availability architecture.
• Identify security gaps, configuration deficiencies, vulnerabilities, and operational risks.
• Develop prioritized remediation plans and provide documented recommendations.

2. Next Generation Firewall Migration and Deployment

• Develop migration strategies and implementation plans for the Next Generation Firewall environment.
• Perform firewall configuration cleanup and prepare existing environments for migration.
• Configure Palo Alto Networks firewalls, Panorama, security services, and associated components.
• Migrate existing firewall configurations, policies, rules, and security profiles into the Next Generation environment.
• Implement network segmentation, security zones, routing rules, and firewall policies.
• Configure high-availability architecture and conduct failover validation.
• Develop and execute functional, operational, connectivity, performance, and failover testing.
• Support production deployment, migration cutovers, and after-hours implementation activities when required.
• Troubleshoot and resolve migration-related technical issues.
• Maintain project status reports, risk logs, issue tracking, and change-management documentation.

3. Security Optimization and Best Practices

• Implement Palo Alto Networks security best practices and recommended architecture improvements.
• Optimize security policies, security profiles, and threat-prevention configurations.
• Design and configure centralized monitoring, dashboards, alerting, and reporting using Panorama and applicable native Palo Alto Networks tools.
• Utilize Strata Cloud Manager and Strata Logging Service where applicable and licensed.
• Configure weekly and monthly security reporting, operational metrics, and historical performance trending.
• Provide technical advisory services and troubleshooting support.
• Identify opportunities to improve network visibility, security posture, operational efficiency, and system stability.
• Coordinate technical escalations and support ticket submissions with Palo Alto Networks when required.

4. Documentation and Knowledge Transfer

• Develop and maintain comprehensive technical and implementation documentation.
• Prepare final as-built architecture and configuration documentation.
• Document standard operating procedures, firewall administration processes, monitoring, and troubleshooting procedures.
• Conduct structured knowledge-transfer sessions for designated network engineering and operations personnel.
• Prepare training materials and documentation to support long‑term operational readiness.

Minimum Qualifications

Candidates must demonstrate the following experience through specific, verifiable client project engagements:

• Minimum 10 years of expert‑level hands‑on experience with Palo Alto Networks technologies in large‑scale enterprise environments, including NGFW architecture, implementation, configuration, migration, Panorama, and operational support.
• Minimum 10 years of experience conducting enterprise cybersecurity assessments, including firewall architecture reviews, security policy evaluations, threat‑prevention assessments, vulnerability identification, risk analysis, and security remediation recommendations.
• Proven experience planning and executing large‑scale firewall migrations involving at least 5 pairs (10 total) of firewalls within a single migration program or project. Experience must include configuration cleanup, policy migration, failover testing, validation, troubleshooting, and production cutovers.
• Minimum 10 years of experience implementing Palo Alto Networks vendor‑recommended and industry‑recognized security best practices, including centralized monitoring, alerting, dashboards, reporting, and trending using native Palo Alto Networks tools.
• Minimum 10 years of experience developing enterprise network security documentation, as‑built deliverables, operational procedures, and conducting technical knowledge‑transfer and training sessions.
• Minimum 3 years of experience with advanced Palo Alto Networks security services and solutions, including:
• Advanced Threat Prevention (ATP)
• Prisma Access
• Prisma Cloud
• Associated security management and reporting capabilities.

Required Platform Experience

• Palo Alto Networks PA‑7500, PA‑5450, PA‑3000 series or equivalent platforms.
• Next Generation Firewalls (NGFW).
• High Availability (HA) and failover configurations.
• Multi‑zone firewall environments with 1,000+ policies.
• High‑traffic firewall environments exceeding 10Gbps throughput.
• Prisma Access and SASE deployments.
• Advanced Threat Prevention.
• Strata Cloud Manager and Strata Logging Service, where applicable.

Additional Requirements

• Experience in enterprise environments covering at least 5 physical locations and 20,000+ users.
• Strong experience in complex network security architecture and migration programs.
• Ability to provide verifiable end‑client project references.
• Strong technical documentation, communication, troubleshooting, and stakeholder coordination skills.
• Availability to support after‑hours firewall migration cutovers when required.