Network Security Engineer

About the Role

This role focuses on network security, specifically involving firewalls and cloud networking platforms.

Key Responsibilities

• Perform core firewall skills including basic troubleshooting, and configuration management for Fortinet FortiGate and Palo Alto Networks firewalls.
• Manage interface, zone, and VDOM configuration, including HA pairs.
• Create, review, and troubleshoot firewall policies, considering source, destination, service, NAT, and security profiles.
• Configure and troubleshoot routing protocols such as static routes, BGP, and OSPF.
• Perform basic troubleshooting for IPsec site-to-site and SSL VPNs.
• Check HA status, validate failover, and ensure config sync.
• Diagnose session and traffic issues using tools like packet sniffers and debug flows.
• Review logs and perform threat/event analysis via FortiAnalyzer or firewall logs.
• Plan and execute firmware upgrades and manage configuration backups/restores.
• Navigate and manage PAN-OS via web UI and CLI.
• Configure security policies, NAT policies, and zone-based configurations.
• Implement and manage security profiles (Antivirus, Anti-Spyware, URL Filtering, File Blocking, WildFire).
• Configure routing on virtual routers.
• Manage IPsec tunnels and GlobalProtect basics.
• Check HA status and perform failover checks.
• Utilize troubleshooting tools like show session all, test security-policy-match, packet-capture, and debug dataplane.
• Perform Panorama basics for centralized management.
• Plan and execute Content and PAN-OS upgrades.
• Apply vendor-neutral firewall concepts such as stateful inspection, NAT, and zone-based design.
• Troubleshoot using an OSI layer approach with tools like ping, traceroute, packet capture, and logs.
• Understand BGP fundamentals, IPsec, and TLS basics.
• Identify and resolve issues related to asymmetric routing.
• Adhere to change management and rollback practices.
• Manage Microsoft Azure networking components including VNets, peering, Route Server, ExpressRoute, VPN Gateway, Network Security Groups, and route tables.
• Understand Azure NVA deployment in hub-spoke topologies.
• Manage Route Server and BGP peering, learned/advertised routes, and route preference.
• Understand ExpressRoute and Global Reach basics.
• Utilize Azure permissions and tools like Azure Portal, Azure CLI, and Network Watcher.
• Apply routing and switching fundamentals such as VLANs, subnetting, ARP, and L2 extension concepts.
• Implement security policy hardening and least-privilege rule design.
• Perform threat log analysis and incident triage.
• Gain basic familiarity with SIEM tools like Splunk, Microsoft Sentinel, or FortiAnalyzer.
• Maintain awareness of vulnerabilities and patches for firewall OS and platform software.
• Support incident response by performing containment steps, evidence collection, and escalations.
• Understand the cybersecurity lifecycle.
• Execute changes following approved plans, runbooks, and rollback steps.
• Maintain operating procedures, configuration records, and network diagrams.
• Use ticketing and workflow tools like ServiceNow or Jira.
• Support transitions and migrations, including cutovers and parallel runs.
• Coordinate with teams during maintenance windows.
• Provide clear status updates and escalate blockers.
• Collect firewall and security metrics on a routine basis.
• Produce weekly or monthly reports for senior engineers and management.
• Track change success rates, incident trends, and patch compliance.
• Use dashboards in FortiAnalyzer, Palo Alto Panorama or Cortex, Azure Monitor, or similar tools.

Requirements & Tech Stack

• Fortinet FortiGate
• FortiOS CLI and GUI
• FortiGate HA
• FortiAnalyzer
• Palo Alto Networks
• PAN-OS
• Panorama
• Microsoft Azure networking (VNets, peering, Route Server, ExpressRoute, VPN Gateway, NSGs, UDR)
• Azure CLI
• Network Watcher
• ServiceNow, Jira, or similar ticketing tools
• Splunk, Microsoft Sentinel, or FortiAnalyzer (SIEM familiarity)

Qualifications

• BA/BS degree and 0-2 years’ relevant experience OR equivalent combination of education and experience.
• Firewall Security Engineer experience.
• Basic troubleshooting skills.
• Experience with Fortinet and Palo Alto firewalls.
• Any Firewall Experience.
• Understanding of FortiOS CLI and GUI navigation.
• Interface, zone, and VDOM configuration.
• HA pairs configuration (e.g., FGT-A/B).
• Firewall policy creation, review, and troubleshooting.
• Routing configuration and troubleshooting (static routes, BGP, OSPF, policy-based routing).
• Basic VPN troubleshooting (IPsec site-to-site, SSL VPN).
• HA status checks, failover validation, and config sync.
• Session and traffic troubleshooting tools (sniffer packet, debug flow, get router info bgp, session table review).
• Log review and threat/event analysis.
• Firmware upgrade planning and config backup/restore.
• PAN-OS navigation (web UI and CLI).
• Security policy, NAT policy, and Zone-based configuration.
• Security profiles (Antivirus, Anti-Spyware, URL Filtering, File Blocking, WildFire).
• Routing on virtual routers (static, BGP, OSPF).
• VPN (IPsec tunnels, GlobalProtect basics).
• HA (active/passive, active/active) status and failover checks.
• Troubleshooting tools: show session all, test security-policy-match, packet-capture, show routing route, debug dataplane, system and traffic logs.
• Panorama basics for centralized management.
• Content and PAN-OS upgrade planning.
• Understanding of Stateful inspection, NAT (SNAT, DNAT, PAT), and zone-based design.
• OSI layer troubleshooting approach.
• BGP fundamentals (peering, AS-path, local preference, route advertisement).
• IPsec and TLS basics.
• Understanding of asymmetric routing and its impact on sessions.
• Familiarity with change management and rollback practices.
• Microsoft Azure networking components: VNets, peering, Route Server, ExpressRoute, VPN Gateway, Network Security Groups, and route tables (UDR).
• Understanding of firewall appliances deployed as virtual machines in hub-spoke topologies.
• Route Server and BGP (peer status, learned and advertised routes, route preference).
• ExpressRoute and Global Reach basics.
• Azure permissions and tools: Azure Portal, Azure CLI, and Network Watcher (connection troubleshoot, NSG flow logs, IP flow verify).
• Routing and switching fundamentals: VLANs, subnetting, ARP, and L2 extension concepts.
• Security policy hardening and least-privilege rule design.
• Threat log analysis and incident triage (IPS, malware, malicious URL, and blocked-traffic events).
• Basic SIEM familiarity.
• Vulnerability and patch awareness for firewall OS and platform software.
• Incident response support: containment steps, evidence collection, and escalation.
• Understanding of the cybersecurity lifecycle: identify, protect, detect, respond, recover.
• Change execution: Following approved change plans, runbooks, and rollback steps.
• Documentation: Maintaining operating procedures, configuration records, and network diagrams.
• Ticketing and workflow: Using ServiceNow, Jira, or similar tools.
• Transitions and migrations: Supporting cutovers, parallel runs, and knowledge transfer.
• Coordination: Working with GITS, application owners, and senior engineers.
• Communication: Clear status updates, escalation of blockers, and stakeholder notifications.
• Collecting firewall and security metrics.
• Producing reports.
• Tracking change success rate, incident trends, and patch compliance.
• Using dashboards.