Senior Palo Alto Firewall Engineer — TS/SCI On‑Site

RISA; Springfield (VA); On-site; USD 117,000 - 128,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) and Roth

Job summary

RISA is seeking a Palo Alto SME in Springfield, VA to own the Palo Alto estate across PA-3000/5000 hardware, Prisma Access, VM-Series, and Cortex. You will drive secure network architectures, lead hardware refreshes, and manage centralized policy with Panorama.

Required TS/SCI, ability to obtain a polygraph, and 7+ years of hands-on Palo Alto NGFW experience; PCNSE certification and DoD IAT II compliance are essential. On-site role with up to 15% travel.

Qualifications

• Bachelor's degree in a field applicable to the position plus 6 years of relevant experience; equivalents accepted - Master's +4, Associate's +8, or HS diploma +10.
• 7+ years hands‑on administering, configuring, and troubleshooting Palo Alto NGFWs in large‑scale environments.
• Active PCNSE certification.
• DoD 8140.01 and 8570.01-M IAT Level II (e.g. Security+ CE), and CSSP Infrastructure Support within 120 days of start.
• Deep knowledge of PA-3000 and PA-5000 hardware, legacy CLI, troubleshooting, line‑card replacement.
• Prisma Access (SASE), Prisma SD‑WAN, and VM‑Series in AWS, Azure, or GCP.
• Panorama template and device‑group inheritance across a hybrid fleet.
• Advanced BGP, OSPF, IPSec VPN, and NAT.

Responsibilities

• Serve as the lead technical authority for administering and troubleshooting Palo Alto NGFWs.
• Lead the design, analysis, testing, and implementation of secure network architectures on the Palo Alto stack.
• Manage the full hardware and software lifecycle, including refreshes and PAN-OS upgrades on legacy platforms.
• Run Panorama for centralized policy management across a fleet of physical and virtual firewalls.
• Configure master-level security profiles - App-ID, User-ID, Content-ID, SSL Decryption, and WildFire.
• Own configuration management processes and SOPs for all Palo Alto platforms.
• Mentor junior engineers and escalate complex troubleshooting as needed.
• Liaise with contract, customer, and government DAA on network security status, policies, and procedures.

Skills

PCNSE

Palo Alto NGFWs

Prisma Access

VM-Series

Panorama

App-ID

User-ID

Content-ID

SSL Decryption

WildFire

BGP

OSPF

IPSec VPN

NAT

Python

Ansible

Terraform

REST APIs

Education

Bachelor's degree + 6 years relevant experience

Tools

Ansible

Terraform

Palo Alto XML/REST APIs

AWS

Azure

GCP

Job description

RISA is seeking a Palo Alto SME in Springfield, VA to own the Palo Alto estate across PA-3000/5000 hardware, Prisma Access, VM-Series, and Cortex. You will drive secure network architectures, lead hardware refreshes, and manage centralized policy with Panorama.

Required TS/SCI, ability to obtain a polygraph, and 7+ years of hands-on Palo Alto NGFW experience; PCNSE certification and DoD IAT II compliance are essential. On-site role with up to 15% travel.