Principal Cybersecurity Transformation Advisor - Firewall & Network Security

Principal Cybersecurity Transformation Advisor - Firewall & Network Security

Job Number: 26-04489

Progress on your journey to success! ECLARO is currently recruiting for a Principal Cybersecurity Transformation Advisor - Firewall & Network Security in the Buffalo, NY area for one of our clients.

ECLARO’s client is a leading provider of healthcare workforce software and solutions. If you’re up to the challenge, then take a chance at this rewarding opportunity!

Position Overview

• Seeking a Senior Cybersecurity Transformation Advisor to lead strategy, architecture, and execution for a large-scale enterprise firewall and network security policy transformation within a highly regulated financial services environment.
• This role combines executive-level advisory with hands-on technical leadership across policy discovery, rationalization, migration, automation, validation, governance, and operational transition.
• The ideal consultant has led complex, multi-year firewall transformation programs involving thousands of Layer 3 / 4 and Layer 7 rules across data centers, cloud, campus, and edge environments.
• They can engage CISOs and Senior Technology Leaders while working credibly with architects and engineers on routing, NAT, zones, objects, application-aware policies, segmentation, rule dependencies, migration sequencing, and cutover risk.
• This is a high-visibility consulting role for a transformation leader who can establish the target-state vision, translate it into an executable roadmap, govern delivery, and remain technically engaged through implementation and operational handoff.

Responsibilities

• Cybersecurity Strategy & Transformation:
• Lead current-state assessment and target-state design for enterprise firewall, segmentation, and network security policy capabilities.
• Define the transformation roadmap, workstreams, migration waves, governance model, architecture principles, delivery controls, and measurable outcomes.
• Direct discovery and normalization of firewall rules, objects, services, NAT, zones, applications, user context, and policy dependencies across complex multi-vendor estates.
• Guide the conversion of legacy Layer 3 / 4 access rules into appropriately governed Layer 7 and application-aware policy, using least privilege and business intent.
• Establish policies for rule cleanup, deduplication, recertification, exception handling, ownership, expiration, decommissioning, and evidence retention.
• Own transformation risk management, including dependency mapping, migration sequencing, rollback criteria, outage avoidance, and post-change validation.
• Align security architecture, network engineering, application teams, risk, compliance, operations, and business stakeholders around the transformation plan.
• Firewall Policy Engineering & Technical Leadership:
• Provide design authority for firewall policy architecture, network segmentation, application connectivity, and secure access patterns.
• Lead technical analysis of Layer 3 / 4 and Layer 7 policies, including source, destination, service, application, identity, NAT, routing, zone, and security-profile implications.
• Validate rule-conversion logic and resolve issues involving shadowed, redundant, overly permissive, stale, or undocumented rules and objects.
• Define migration factories, engineering standards, reusable patterns, quality gates, and test approaches that support safe execution at enterprise scale.
• Guide pre-cutover testing, traffic and path analysis, implementation rehearsals, rollback planning, post-cutover verification, and exception resolution.
• Review detailed designs and implementation artifacts, challenge technical assumptions, and make risk-based decisions when business intent or rule ownership is unclear.
• Coach architects and engineers while maintaining clear executive visibility into delivery progress, technical debt, risk, and decisions.
• Tufin, Check Point & Multi-Vendor Transformation:
• Serve as the lead advisor for Tufin-based security policy management, with strong experience in SecureTrack and SecureChange capabilities, workflow design, topology and path analysis, compliance controls, rule lifecycle management, and change automation.
• Lead transformation of Check Point firewall policy, including objects, groups, services, NAT, layered policy, access control, application control, management domains, and operational processes.
• Assess and guide Palo Alto Networks policy migration or coexistence where applicable, including Panorama-managed environments, application-aware policy, zones, tags, identity context, security profiles, and rule ordering.
• Define integration requirements across Tufin, firewall management platforms, IT service management, CMDB, IPAM, vulnerability management, and reporting systems.
• Design governed workflows for access requests, risk analysis, approvals, automated policy design, provisioning, verification, recertification, and audit evidence.
• Evaluate automation opportunities while preserving segregation of duties, change control, traceability, and human approval for higher-risk changes.
• Transformation Governance & Executive Advisory:
• Serve as a trusted advisor to cybersecurity, network, infrastructure, risk, and business executives throughout the transformation.
• Translate complex policy, architecture, migration, and operational risks into clear decisions, investment priorities, and executive recommendations.
• Establish program governance, decision rights, workstream accountability, architecture review, dependency management, escalation paths, and executive reporting.
• Define and track transformation measures such as rule reduction, application coverage, policy compliance, change-cycle time, automation rate, recertification completion, exception aging, deployment quality, and incident impact.
• Build business cases and investment rationales for tooling, engineering capacity, remediation, migration, and operating-model changes.
• Ensure the transformed capability is sustainable through documentation, knowledge transfer, role clarity, support procedures, and operational readiness.
• Risk & Regulatory Alignment:
• Ensure the transformation aligns with financial-services regulatory expectations, enterprise risk requirements, change controls, cybersecurity standards, and operational resilience objectives.
• Partner with Risk, Compliance, Audit, Legal, and control functions to define evidence, approvals, exception processes, and audit-ready reporting.
• Incorporate segmentation standards, least privilege, policy ownership, periodic recertification, and compensating controls into the target operating model.
• Identify and communicate material risks arising from undocumented access, broad rules, application ambiguity, unsupported platforms, weak ownership, or incomplete migration evidence.

Required Qualifications

• 12+ years of progressive experience in cybersecurity, network security, security architecture, or consulting, including significant responsibility for enterprise transformation delivery.
• Proven leadership of at least one large-scale firewall or network security policy transformation involving complex rulebases, multiple environments, and regulated change processes.
• Deep practical knowledge of firewall policy design and migration across Layer 3 / 4 and Layer 7 controls, including routing, NAT, zones, objects, services, applications, identity, segmentation, and rule-order behavior.
• Strong hands-on experience with Tufin, particularly SecureTrack and SecureChange, applied to policy discovery, analysis, workflow, compliance, recertification, automation, and verification.
• Advanced experience with Check Point firewalls and management platforms in large enterprise environments.
• Ability to assess policy intent, trace connectivity end to end, identify migration dependencies, and make technically sound tradeoffs under delivery pressure.
• Experience establishing transformation roadmaps, governance, migration waves, quality gates, testing strategies, cutover plans, and operating-model changes.
• Credibility with engineers and architects combined with the ability to advise CISOs, CIOs, risk leaders, and executive steering committees.
• Demonstrated success influencing across cybersecurity, network, infrastructure, application, risk, compliance, audit, and business teams without direct authority.
• Excellent written and verbal communication, including executive presentations, architecture decisions, transformation plans, risk narratives, and business cases.
• The strongest consultant will be more than a cybersecurity subject-matter expert.
• They will be:
• Transformation-led: Has personally shaped and delivered complex security change from strategy through implementation and operational adoption.
• Technically authoritative: Can challenge detailed firewall designs, migration logic, Tufin workflows, rule analysis, and validation evidence.
• Executive-ready: Converts technical complexity into clear decisions, investment needs, delivery priorities, and risk statements.
• Outcome-oriented: Focuses on measurable risk reduction, policy quality, operational efficiency, delivery predictability, and sustainable ownership.
• Pragmatic: Balances target-state architecture with application constraints, legacy dependencies, regulatory obligations, timelines, and service continuity.
• Influential: Creates alignment across security, network, application, infrastructure, operations, and control functions.
• Decisive under ambiguity: Can establish a defensible path forward when documentation, ownership, or business intent is incomplete.

Preferred Experience

• 10,000-plus-rule enterprise firewall estates, multi-domain environments, or globally distributed transformation programs.
• Palo Alto Networks and Panorama migration, coexistence, or policy optimization experience.
• Check Point-to-Palo Alto, legacy-to-next-generation firewall, data center, cloud, or hybrid policy migrations.
• Tufin integration with IT service management, CMDB, IPAM, vulnerability management, and automated provisioning workflows.
• Application dependency mapping, traffic analysis, policy usage analysis, and business-owner recertification at scale.
• Financial services, banking, insurance, healthcare, or another highly regulated industry.
• Segmentation, Zero Trust, cloud network security, data center modernization, or merger and acquisition integration.
• Consulting experience leading client workshops, executive steering committees, technical design authorities, and delivery recovery efforts.
• Development of security policy standards, control frameworks, operating models, and audit evidence for large enterprises.

Preferred Skills

• One or more of the following is preferred:
• CISSP, CISM, CCSP, or CRISC
• Check Point Certified Security Expert or comparable advanced Check Point certification.
• Palo Alto Networks Certified Network Security Engineer or comparable advanced Palo Alto Networks certification.
• Tufin product training or demonstrated equivalent delivery experience.
• GIAC, SABSA, or relevant cloud and network security certifications.

Salary

$200,000 - $210,000 / Year

If interested, you may contact

Lisa Pelletier

Lisa.Pelletier@eclaro.com

646-695-2949

Equal Opportunity Employer

ECLARO values diversity and does not discriminate based on Race, Color, Religion, Sex, Sexual Orientation, National Origin, Age, Genetic Information, Disability, Protected Veteran Status, or any other legally protected group status, in compliance with all applicable laws.