Senior Palo Alto Firewall Architect

Position Overview:

Our client is is seeking a senior, self-directed Palo Alto Firewall Architect to provide enterprise-wide ownership and technical oversight of a large, mission-critical firewall environment supporting a healthcare customer. This hands-on role will retain internal accountability for architecture, standards, security, risk management, and service performance while providing technical governance of a Managed Service Provider. The successful candidate will independently drive complex initiatives to completion and perform engineering and troubleshooting, not only high-level architecture and recommendations.

Responsibilities:

• Own the enterprise firewall architecture, standards, lifecycle, and technical roadmap.
• Provide technical governance and oversight of the MSP performing firewall, virtual private network (VPN), certificate, and key-management operations.
• Design and implement network segmentation supporting mission-critical services and enterprise security initiatives.
• Lead complex firewall deployments, migrations, upgrades, data-center initiatives, and new-site integrations.
• Configure, maintain, and optimize Palo Alto Networks next-generation firewalls (NGFW), Panorama, GlobalProtect, and related security services through the MSP.
• Oversee the transition from legacy Cisco AnyConnect VPN services to Palo Alto GlobalProtect, including planning, testing, user migration, communications, and decommissioning.
• Develop, review, and optimize security policies, Network Address Translation (NAT), security zones, objects, routing, and firewall configurations.
• Establish and maintain standards for firewall, VPN, GlobalProtect, web, device, authentication, encryption, and service certificates.
• Govern the certificate lifecycle, including discovery, inventory, issuance, installation, renewal, replacement, revocation, expiration monitoring, and decommissioning.
• Oversee secure generation, storage, protection, rotation, backup, recovery, escrow, and retirement of cryptographic keys.
• Coordinate certificate and key changes with the MSP, cybersecurity, Identity and Access Management (IAM), application owners, and service owners.
• Serve as the senior escalation point for complex firewall, VPN, certificate, key-management, and network-security issues.
• Establish MSP support standards for incident response, change control, service levels, maintenance, documentation, and escalation procedures.
• Review MSP work for technical quality, security compliance, adherence to standards, and alignment with enterprise architecture.
• Partner with network, cybersecurity, infrastructure, IAM, application, and technology teams to deliver secure solutions.
• Maintain accurate architecture diagrams, configuration standards, support procedures, certificate and key inventories, and technical documentation.
• Provide technical leadership, mentoring, and knowledge transfer to engineering and operations teams.

Qualifications:

• Extensive experience designing, implementing, and supporting Palo Alto Networks firewalls in an enterprise environment.
• Strong hands-on experience with Palo Alto NGFW, Panorama, GlobalProtect, firewall policy, NAT, routing, and security zones.
• Experience with GlobalProtect and Cisco AnyConnect VPN environments, including VPN migration or decommissioning activities.
• Experience overseeing MSP or managed-services delivery in a complex enterprise environment.
• Strong knowledge of enterprise certificate management, Public Key Infrastructure (PKI), certificate authorities, certificate chains, Transport Layer Security (TLS), certificate-based authentication, and cryptographic key management.
• Experience with secure key storage, rotation, access control, backup and recovery, and protection of private keys and sensitive cryptographic material.
• Experience leading firewall migrations, data-center deployments, segmentation projects, and complex technical initiatives.
• Strong network-security architecture background across data-center, cloud, and distributed environments.
• Knowledge of zero-trust principles, secure remote access, and hybrid connectivity.
• Strong troubleshooting, communication, documentation, and stakeholder-management skills.
• Ability to work independently, take ownership, and drive initiatives through completion.
• Palo Alto Networks Certified Network Security Engineer (PCNSE) certification highly preferred.
• Cisco Certified Internetwork Expert (CCIE) Security, Certified Information Systems Security Professional (CISSP), or comparable senior security certification highly preferred.
• Experience supporting healthcare, highly regulated, or mission-critical environments preferred.
• Experience establishing MSP governance, operational standards, service-level expectations, and performance metrics preferred.
• Experience developing technical standards and mentoring engineering teams preferred.