Intermediate Firewall Engineer

Location: Oakton, VA

About the role

The Intermediate Firewall Engineer is responsible for core engineering, day-to-day administration, and operational maintenance of enterprise boundary defense platforms and network security appliances. This role serves as the Tier 2/3 escalation and implementation lead, translating architectural designs into active, secure firewall configurations across on-premises and classified mission enclaves (DMSS, Secret/SAP, TS/SCI/SAP). Key duties include managing Palo Alto Networks firewalls via Panorama, troubleshooting Site-to-Site IPsec VPN tunnels, administering dynamic routing protocols (BGP/OSPF), coordinating scheduled PAN-OS software updates, and enforcing continuous compliance with DISA STIGs and DoD change-management standards. The position bridges strategic engineering initiatives with routine operational support, providing escalation resolution for junior staff and operational support to the Senior Firewall Engineer.

Responsibilities

• Administer, configure, and maintain Palo Alto Networks Next-Generation Firewalls (NGFW) via enterprise Panorama and direct management interfaces in strict alignment with change control protocols.
• Provision and deploy security policies, App-ID rules, TLS/SSL decryption policies, dynamic NAT/PAT schemes, and standardized security objects across multi-tenant environments.
• Serve as the Tier 2/3 operational escalation point, investigating and resolving complex network connectivity failures, IPsec VPN tunnel drops, routing anomalies, and application performance bottlenecks.
• Implement dynamic routing protocols (BGP, OSPF), VLAN segmentation, and perimeter access controls to maintain resilient edge connectivity and segmentation across mission partner enclaves.
• Lead remote site management for performers and external stakeholders across classified networks, including establishing, monitoring, and maintaining IPsec tunnels, VPN gateways, and operational telemetry.
• Plan, coordinate, and execute scheduled PAN-OS maintenance updates, dynamic threat content releases, antivirus definitions, and security patches under the direction of senior engineering leads.
• Maintain rigorous Authority to Operate (ATO) and security posture baselines by executing DISA STIG checklists, remediating vulnerability scan findings, and updating PO&AM documentation.
• Provide incident isolation support to the Security Operations Center (SOC), validating security telemetry log-forwarding pipelines and isolating traffic anomalies during cyber events.
• Maintain comprehensive technical configuration records, network topology diagrams, change audit logs, and operational standard operating procedures (SOPs) within ticketing and project systems (e.g., Redmine, Jira).
• Provide operational mentorship and technical guidance to Junior Firewall Engineers, reviewing routine change requests and assisting in complex troubleshooting workflows.
• Other duties as assigned.

Qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field with 4+ years of hands-on network security/firewall engineering experience; OR High school diploma or GED equivalent with 8+ years of demonstrable operational experience in lieu of a degree.
• Must meet DoD 8140 / 8570.01-M IAT Level II baseline certification requirements (e.g., CompTIA Security+ CE, CCNA Security, CySA+).
• Vendor technical certification: Palo Alto Networks Certified Network Security Administrator (PCNSA) required; Palo Alto Networks Certified Network Security Engineer (PCNSE) preferred.
• Active Secret security clearance with eligibility to obtain TS/SCI/SAP.

Skills

• Strong operational knowledge of Palo Alto Networks NGFW administration, Panorama centralized management, and PAN-OS feature sets (App-ID, Content-ID, User-ID).
• Proven experience building, troubleshooting, and tuning Site-to-Site IPsec VPN tunnels, Global Protect remote access gateways, and dynamic NAT/PAT policies.
• Solid working knowledge of dynamic routing protocols (BGP, OSPF), static routing, sub-netting, and Layer 2/3 switching fabrics.
• Practical understanding of DoD RMF, DISA STIG validation, and boundary protection compliance checklists.
• Experience integrating firewall telemetry and syslog forwarding with SIEM/SOAR platforms (Splunk, Cribl, XSOAR) and network visibility fabrics (IXIA Packet Brokers).
• Strong analytical and packet-level troubleshooting skills utilizing tools such as Wireshark, TCPdump, and Panorama traffic/threat inspection logs.
• Familiarity with IT Service Management (ITSM) workflows, strict configuration change management boards (CCB), and tracking platforms (Jira, ServiceNow, Redmine).

Pay

Estimated salary range: USD $119,700 – $140,000 per year.