Cornerstone is hiring an expert-level Palo Alto Networks Security Engineer for a two-year, full-time consulting engagement at a major international airport in the San Francisco Bay Area.
About the role
The airport is modernizing its network as part of a Next-Generation Network program. The program includes a 400 Gbps backbone and a new Palo Alto Networks Next-Generation Firewall (NGFW) architecture. This architecture segments the airport's airline, concession, enterprise, and critical operations networks.
You will lead the security side of this work. You will assess the current firewall setup, check the new design, run the migration, set up monitoring, and train the airport's staff to run the new system. You will work closely with network, security, and project management teams.
Key responsibilities
Assessment
- Assess the current and planned Palo Alto Networks architecture, NGFW configurations, and Next-Generation Internet Edge design.
- Review Panorama and firewall baselines, including interfaces, zones, routing, and high-availability (HA) design.
- Evaluate security policies, security profiles, and Advanced Threat Prevention (ATP) settings.
- Write findings, gap and risk analyses, and remediation recommendations.
Migration
- Build migration strategies, implementation plans, and test plans.
- Clean up existing configurations and migrate firewall rules and policies to the new environment.
- Configure firewalls, Panorama, security zones, segmentation, and HA, and validate failover.
- Run functional, failover, performance, and connectivity testing.
- Support cutovers, including after-hours work when needed.
- Track risks, issues, and dependencies, and support change management. Submit weekly status reports.
Best practices and monitoring
- Apply Palo Alto Networks best practices to policies, profiles, and threat prevention.
- Set up dashboards, alerts, and weekly and monthly reports using native tools such as Panorama, Strata Cloud Manager, and Strata Logging Service.
- Configure historical trending and performance analysis.
- Troubleshoot issues and open and escalate tickets with Palo Alto Networks.
Documentation and knowledge transfer
- Deliver as-built documentation and standard operating procedures (SOPs).
- Lead knowledge-transfer sessions for airport staff.
Required qualifications
- 10+ years of expert-level Palo Alto Networks experience in large enterprises. This means campuses with 5 or more locations and 20,000 or more users. Your work must cover design, assessment, setup, migration, and ongoing support of NGFWs and Panorama. It must include HA deployments, firewalls with more than 10G of throughput, and multi-zone environments with 1,000 or more policies.
- Hands-on experience with PA-7500, PA-5450, or PA-3000 series firewalls (or equivalent platforms).
- 10+ years of enterprise cybersecurity assessments. This includes firewall architecture and configuration reviews, policy reviews, threat-prevention checks, and gap, vulnerability, and risk analysis.
- Large firewall migrations of at least 5 HA pairs (10 firewalls) in one program. This includes config cleanup, policy translation, failover testing, end-to-end validation, and production cutovers. It also includes status reporting and change management.
- 10+ years of applying Palo Alto Networks best practices. This includes monitoring, alerts, dashboards, reporting, and trend analysis using native Palo Alto Networks tools such as Panorama and its logging tools, not third-party tools.
- 10+ years of writing technical documentation (as-builts, SOPs, troubleshooting guides) and training network and operations teams.
- 3+ years with advanced Palo Alto Networks services, including Advanced Threat Prevention, Prisma Access, Prisma Cloud, and related management and reporting tools.
- Ability to pass an airport security background check and badging process.
Preferred qualifications
- Palo Alto Networks certifications, such as PCNSE.
- Experience with Prisma SD-WAN, Prisma Access, and SASE deployments.
- Experience with Strata Cloud Manager and Strata Logging Service.
- Experience in airports, transportation, critical infrastructure, or the public sector.
- Strong written and spoken communication.
On Site position - SFO
Salary range: $140,000 to $185,000 YR