What You Bring Must-Have: - 5+ years of network security engineering supporting production environments - 5+ years of IT systems or application engineering and administration - Strong working knowledge of all layers of the OSI model - Hands-on Layer-7 protection experience: application control, TLS inspection, IPS, URL and DNS filtering - Direct experience administering enterprise NGFW/UTM platforms - Experience implementing and supporting 802.1X wired and wireless NAC - Experience with enterprise remote access VPN - Experience working within a formal change management process, with clear written and verbal communication across security, IT, product, and operations teams Nice-to-Have: - Relevant certifications such as PCNSE, Security+, or CISSP - Scripting or automation experience for configuration and reporting (Python, Ansible, Terraform) - Experience in a regulated or safety-critical environment - Experience with network segmentation and SSL decryption enforcement - Strong runbook and network diagram documentation habits Technical Environment: - Enterprise NGFW/UTM platforms, URL filtering, and Layer-7 inspection - IDS/IPS and TLS/SSL decryption - 802.1X wired and wireless NAC - Remote access VPN - ITSM ticketing and formal change management What Success Looks Like: - Tickets closed to SLA, with satisfied requesters - Changes land cleanly, with no change-caused incidents - Project milestones hit on agreed dates, with complete documentation at handoff What You'll Do - Administer next-gen firewall and UTM platforms, including policy changes, rule cleanup, software and signature updates, and certificate renewals - Operate URL filtering and Layer-7 inspection policies, including category tuning and exception handling - Tune IDS/IPS signatures, reduce false positives, and escalate confirmed detections to the security operations team - Support 802.1X network access control, including supplicant, certificate, and policy troubleshooting and onboarding new device types - Support remote access VPN, including client troubleshooting, access and split-tunnel policy changes, and availability monitoring - Work the ticket queue to SLA with clear written updates to requesters - Maintain runbooks, network diagrams, and configuration documentation - Deliver scoped projects, including an 802.1X expansion and segmentation with SSL decryption enforcement Requirements.