Senior Network Engineer

CBTS; United States; Remote; USD 120,000 - 190,000; Full time

Job summary

CBTS is seeking a Senior Network Firewall Engineer to join the VPN services team during a large-scale migration from Cisco AnyConnect to Palo Alto Prisma Access (GlobalProtect). This hands-on role will set technical direction for scripting and tooling and perform the work themselves, with no third-party vendors.

You will lead design, configuration, and automation tasks, mentor junior engineers, and report migration progress to stakeholders as CBTS completes the rollout for thousands of users.

Qualifications

• 7+ years of network or firewall engineering experience.
• Hands-on Palo Alto firewalls and management tools.
• Proficiency in Python and/or PowerShell for production automation.
• Solid understanding of TCP/IP, NAT, VPN technologies.
• Experience with REST APIs and scripting against network/security platforms.

Responsibilities

• Design, configure, and support Palo Alto Prisma Access and GlobalProtect VPN services
• Lead the technical execution of the phased migration of users and groups from Cisco AnyConnect to Palo Alto
• Design and develop Python and/or PowerShell automation for migration tasks, such as user and group onboarding, policy and configuration builds, validation checks, and reporting
• Automate recurring engineering tasks to reduce manual effort and errors
• Set standards for code quality, testing, and version control on the team’s automation
• Serve as an escalation point for complex connectivity, authentication, and policy issues
• Maintain firewall policies, security profiles, and configuration standards
• Mentor junior engineers and review their scripts and configurations
• Document designs, runbooks, and automation so the team can reuse them
• Partner with network, security, and service desk teams, and report on migration progress to stakeholders

Skills

Firewall engineering

Palo Alto Networks

Python

PowerShell

REST APIs

TCP/IP routing

VPN (SSL/IPsec)

Automation scripting

Tools

Panorama

GlobalProtect

Prisma Access

Cisco AnyConnect/ASA

Job description

*CBTS is a leading IT Solutions Provider with an exceptional track record of delivering results to its clients. With over 27 years of experience, time tested business acumen and a unique vendor neutral approach that ensures unbiased solution design, CBTS is one of the world's leading IT Solution Providers. We "Design Build and Operate" complex, best-of-breed data and data center solutions for highly recognizable customers.

at withstand

About the Role

CBTS is hiring a Senior Network Firewall Engineer to join the VPN services team during a large-scale migration from Cisco AnyConnect to Palo Alto Prisma Access (GlobalProtect). Roughly 22,000 users have moved so far, with about 60,000 remaining [VERIFY]. You will help lead the engineering effort and build the automation that makes the migration repeatable and fast. This is a hands-on senior role: you will set technical direction for the team’s scripting and tooling, and you will still do the work yourself. NO THIRD-PARTY VENDORS.

Responsibilities

• Design, configure, and support Palo Alto Prisma Access and GlobalProtect VPN services
• Lead the technical execution of the phased migration of users and groups from Cisco AnyConnect to Palo Alto
• Design and develop Python and/or PowerShell automation for migration tasks, such as user and group onboarding, policy and configuration builds, validation checks, and reporting
• Automate recurring engineering tasks to reduce manual effort and errors
• Set standards for code quality, testing, and version control on the team’s automation
• Serve as an escalation point for complex connectivity, authentication, and policy issues
• Maintain firewall policies, security profiles, and configuration standards
• Mentor junior engineers and review their scripts and configurations
• Document designs, runbooks, and automation so the team can reuse them
• Partner with network, security, and service desk teams, and report on migration progress to stakeholders

Required Qualifications

• 7+ years of experience in network or firewall engineering
• Deep hands-on experience with Palo Alto Networks firewalls (Panorama, GlobalProtect, or Prisma Access)
• Working knowledge of Cisco AnyConnect or ASA/FTD VPN
• Proficiency in Python and/or PowerShell, with a record of building automation used in production
• Strong understanding of TCP/IP, routing, NAT, SSL/IPsec VPN, and network security fundamentals
• Experience with REST APIs and scripting against network or security platforms
• Strong troubleshooting and written communication skills

Preferred Qualifications

• Experience leading large-scale VPN or remote access migrations
• Familiarity with SAML/SSO, MFA, and identity integrations (Azure AD/Entra ID, Okta)
• Experience with Git, CI/CD, or infrastructure-as-code practices
• Prior experience in an enterprise or managed services environment

Fully virtual position. Requires reliable home internet and a quiet workspace. Occasional off-hours support may be needed during migration cutovers.