Senior Network Firewall Engineer - Prisma Access Migration Lead

CBTS; United States; Remote; USD 120,000 - 190,000; Full time

Job summary

CBTS is seeking a Senior Network Firewall Engineer to join the VPN services team during a large-scale migration from Cisco AnyConnect to Palo Alto Prisma Access (GlobalProtect). This hands-on role will set technical direction for scripting and tooling and perform the work themselves, with no third-party vendors.

You will lead design, configuration, and automation tasks, mentor junior engineers, and report migration progress to stakeholders as CBTS completes the rollout for thousands of users.

Qualifications

• 7+ years of network or firewall engineering experience.
• Hands-on Palo Alto firewalls and management tools.
• Proficiency in Python and/or PowerShell for production automation.
• Solid understanding of TCP/IP, NAT, VPN technologies.
• Experience with REST APIs and scripting against network/security platforms.

Responsibilities

• Design, configure, and support Palo Alto Prisma Access and GlobalProtect VPN services
• Lead the technical execution of the phased migration of users and groups from Cisco AnyConnect to Palo Alto
• Design and develop Python and/or PowerShell automation for migration tasks, such as user and group onboarding, policy and configuration builds, validation checks, and reporting
• Automate recurring engineering tasks to reduce manual effort and errors
• Set standards for code quality, testing, and version control on the team’s automation
• Serve as an escalation point for complex connectivity, authentication, and policy issues
• Maintain firewall policies, security profiles, and configuration standards
• Mentor junior engineers and review their scripts and configurations
• Document designs, runbooks, and automation so the team can reuse them
• Partner with network, security, and service desk teams, and report on migration progress to stakeholders

Skills

Firewall engineering

Palo Alto Networks

Python

PowerShell

REST APIs

TCP/IP routing

VPN (SSL/IPsec)

Automation scripting

Tools

Panorama

GlobalProtect

Prisma Access

Cisco AnyConnect/ASA

Job description

CBTS is seeking a Senior Network Firewall Engineer to join the VPN services team during a large-scale migration from Cisco AnyConnect to Palo Alto Prisma Access (GlobalProtect). This hands-on role will set technical direction for scripting and tooling and perform the work themselves, with no third-party vendors.

You will lead design, configuration, and automation tasks, mentor junior engineers, and report migration progress to stakeholders as CBTS completes the rollout for thousands of users.