Network Security Engineer - Palo Alto Next Gen Firewall (SC Cleared)

Mid-level role within the Security Support team responsible for maintaining the availability, security, and operational health of the enterprise network security estate, focusing on firewalls and SASE services.-

Key Responsibilities

• Operations & Service Management: Support security infrastructure and firewalls following ITIL practices (incident, request, problem, change management).
• Incident & Issue Ownership: Methodically triage, diagnose, remediate, and close incidents; escalate with evidence when needed.
• Change Delivery: Translate requirements into support actions and execute controlled production changes with peer review, testing, and rollback plans.
• Problem Management: Perform root-cause analysis on recurring issues and implement preventative solutions.
• Vendor & Team Coordination: Manage technical escalations with vendors, MSPs, and internal cross-functional IT/security teams.
• Documentation & Governance: Maintain configurations, asset records, runbooks, and diagrams; apply least-privilege principles and audit compliance in a regulated environment.

Technical Requirements

• Networking & Protocols: Strong knowledge of TCP/IP, DNS, DHCP, NAT, TLS, HTTP/S, static/dynamic routing (BGP, OSPF), VRFs, and segmentation.
• Firewall & Security Administration: Hands-on experience with enterprise NGFWs (policy, NAT, VPNs, security profiles) and lifecycle management (upgrades, patching, rule recertification).
• Troubleshooting: Advanced diagnosis using PCAPs, logs, and monitoring tools for asymmetric routing, MTU, authentication, and application connectivity issues.
• Preferred Platforms: Palo Alto / Fortinet (Panorama, FortiManager, FortiAnalyzer), SASE solutions, and F5 (or equivalent load balancers).
• Desirable: AWS/Azure networking, vulnerability management (Tenable), email security (Mimecast), basic scripting/automation (Python, PowerShell, APIs), and ITIL or vendor certifications (PCNSE, NSE, CCNA/CCNP).

Working Conditions

• Shift Rota: Coverage between 08:00 and 18:00, with occasional out-of-hours maintenance as required.
• Clearance: Security Check (SC) clearance required.