Palo Alto Networks Security Engineer – Expert Level

Title: Palo Alto Networks Security Engineer – Expert Level Consultant

Location

San Francisco, CA

Experience

10+ Years

Duration

Estimated 2 Years

Position Overview

San Francisco International Airport (SFO) is undertaking a comprehensive modernization of its network security infrastructure as part of its Next Generation Network program. The initiative includes deployment of a 400Gbps network backbone designed to improve network capacity, reliability, cybersecurity, and operational resilience.

SFO is seeking an expert-level Palo Alto Networks Security Engineer Consultant to support the assessment, architecture validation, migration, implementation, and optimization of its Next Generation Firewall environment.

The consultant will be responsible for evaluating existing and proposed Palo Alto Networks security architectures, implementing firewall migration strategies, optimizing security policies, configuring centralized monitoring and reporting capabilities, and ensuring operational readiness.

The consultant will work closely with network engineering, cybersecurity, infrastructure, and project stakeholders to ensure the deployment aligns with SFO's technical architecture standards and cybersecurity objectives.

Roles and Responsibilities

1. Palo Alto Networks Security Assessment

• Conduct comprehensive assessments of existing and proposed Palo Alto Networks security architectures.
• Evaluate Next Generation Firewall configurations, Panorama management, security policies, security profiles, and threat-prevention capabilities.
• Review Advanced Threat Prevention (ATP) configurations and validate alignment with Palo Alto Networks best practices.
• Assess firewall interfaces, security zones, routing, system configurations, and high-availability architecture.
• Identify security gaps, configuration deficiencies, vulnerabilities, and operational risks.
• Develop prioritized remediation plans and provide documented recommendations.

2. Next Generation Firewall Migration and Deployment

• Develop migration strategies and implementation plans for the Next Generation Firewall environment.
• Perform firewall configuration cleanup and prepare existing environments for migration.
• Configure Palo Alto Networks firewalls, Panorama, security services, and associated components.
• Migrate existing firewall configurations, policies, rules, and security profiles into the Next Generation environment.
• Implement network segmentation, security zones, routing rules, and firewall policies.
• Configure high-availability architecture and conduct failover validation.
• Develop and execute functional, operational, connectivity, performance, and failover testing.
• Support production deployment, migration cutovers, and after-hours implementation activities when required.
• Troubleshoot and resolve migration-related technical issues.
• Maintain project status reports, risk logs, issue tracking, and change-management documentation.

3. Security Optimization and Best Practices

• Implement Palo Alto Networks security best practices and recommended architecture improvements.
• Optimize security policies, security profiles, and threat-prevention configurations.
• Design and configure centralized monitoring, dashboards, alerting, and reporting using Panorama and applicable native Palo Alto Networks tools.
• Utilize Strata Cloud Manager and Strata Logging Service where applicable and licensed.
• Configure weekly and monthly security reporting, operational metrics, and historical performance trending.
• Provide technical advisory services and troubleshooting support.
• Identify opportunities to improve network visibility, security posture, operational efficiency, and system stability.
• Coordinate technical escalations and support ticket submissions with Palo Alto Networks when required.

4. Documentation and Knowledge Transfer

• Develop and maintain comprehensive technical and implementation documentation.
• Prepare final as-built architecture and configuration documentation.
• Document standard operating procedures, firewall administration processes, monitoring, and troubleshooting procedures.
• Conduct structured knowledge-transfer sessions for designated network engineering and operations personnel.
• Prepare training materials and documentation to support long-term operational readiness.

Minimum Qualifications

Candidates must demonstrate the following experience through specific, verifiable client project engagements:

• Minimum 10 years of expert-level hands-on experience with Palo Alto Networks technologies in large-scale enterprise environments, including NGFW architecture, implementation, configuration, migration, Panorama, and operational support.
• Minimum 10 years of experience conducting enterprise cybersecurity assessments, including firewall architecture reviews, security policy evaluations, threat-prevention assessments, vulnerability identification, risk analysis, and security remediation recommendations.
• Proven experience planning and executing large-scale firewall migrations involving at least 5 pairs (10 total) of firewalls within a single migration program or project. Experience must include configuration cleanup, policy migration, failover testing, validation, troubleshooting, and production cutovers.
• Minimum 10 years of experience implementing Palo Alto Networks vendor-recommended and industry-recognized security best practices, including centralized monitoring, alerting, dashboards, reporting, and trending using native Palo Alto Networks tools.
• Minimum 10 years of experience developing enterprise network security documentation, as-built deliverables, operational procedures, and conducting technical knowledge-transfer and training sessions.
• Minimum 3 years of experience with advanced Palo Alto Networks security services and solutions, including:
• Advanced Threat Prevention (ATP)
• Prisma Access
• Prisma Cloud
• Associated security management and reporting capabilities.

Required Platform Experience

• Palo Alto Networks PA-7500, PA-5450, PA-3000 series or equivalent platforms.
• Panorama centralized management.
• Next Generation Firewalls (NGFW).
• High Availability (HA) and failover configurations.
• Multi-zone firewall environments with 1,000+ policies.
• High-traffic firewall environments exceeding 10Gbps throughput.
• Prisma Access and SASE deployments.
• Advanced Threat Prevention.
• Strata Cloud Manager and Strata Logging Service, where applicable.

Additional Requirements

• Experience in enterprise environments covering at least 5 physical locations and 20,000+ users.
• Strong experience in complex network security architecture and migration programs.
• Ability to provide verifiable end-client project references.
• Strong technical documentation, communication, troubleshooting, and stakeholder coordination skills.
• Availability to support after-hours firewall migration cutovers when required.

Submission Requirements

Each candidate must have an individually identifiable resume and documented project experience supporting each applicable minimum qualification. Generic or representative resumes are not accepted.

MQ

Mandatory Requirement

Minimum Experience

MQ1

Expert-level Palo Alto architecture, NGFW, Panorama, deployment, HA and enterprise implementation

10 years

MQ2

Enterprise cybersecurity assessments and firewall/security architecture reviews

10 years

MQ3

Large-scale firewall migration involving minimum 5 pairs / 10 firewalls in one program

Demonstrated experience

MQ4

Palo Alto best practices, native monitoring, alerting, dashboards and reporting

10 years

MQ5

Technical documentation, as-built deliverables, SOPs and knowledge transfer

10 years

MQ6

ATP, Prisma Access, Prisma Cloud and associated security management solutions

3 years

Critical MQ1 enterprise environment definition

• Minimum 5 physical locations.
• 20,000+ users.
• High-traffic environments with firewalls exceeding 10Gbps throughput.
• High-availability deployments.
• Multi-zone environments with 1,000+ policies.