Senior Network Firewall Engineer

Position: Senior Network Firewall Engineer

Location: Remote (East Coast Preferred)

Exp: 8+yrs

Team: Network Security / VPN Services

About the Role

CBTS is hiring a Senior Network Firewall Engineer to join the VPN services team during a large-scale migration from Cisco AnyConnect to Palo Alto Prisma Access (GlobalProtect). Roughly 22,000 users have moved so far, with about 60,000 remaining [VERIFY]. You will help lead the engineering effort and build the automation that makes the migration repeatable and fast. This is a hands-on senior role: you will set technical direction for the team’s scripting and tooling, and you will still do the work yourself.

Responsibilities

• Design, configure, and support Palo Alto Prisma Access and GlobalProtect VPN services
• Lead the technical execution of the phased migration of users and groups from Cisco AnyConnect to Palo Alto
• Design and develop Python and/or PowerShell automation for migration tasks, such as user and group onboarding, policy and configuration builds, validation checks, and reporting
• Automate recurring engineering tasks to reduce manual effort and errors
• Set standards for code quality, testing, and version control on the team’s automation
• Serve as an escalation point for complex connectivity, authentication, and policy issues
• Maintain firewall policies, security profiles, and configuration standards
• Mentor junior engineers and review their scripts and configurations
• Document designs, runbooks, and automation so the team can reuse them
• Partner with network, security, and service desk teams, and report on migration progress to stakeholders

Required Qualifications

• 7+ years of experience in network or firewall engineering
• Deep hands-on experience with Palo Alto Networks firewalls (Panorama, GlobalProtect, or Prisma Access)
• Working knowledge of Cisco AnyConnect or ASA/FTD VPN
• Proficiency in Python and/or PowerShell, with a record of building automation used in production
• Strong understanding of TCP/IP, routing, NAT, SSL/IPsec VPN, and network security fundamentals
• Experience with REST APIs and scripting against network or security platforms
• Strong troubleshooting and written communication skills

Preferred Qualifications

• Palo Alto certification (PCNSE preferred)
• Experience leading large-scale VPN or remote access migrations
• Familiarity with SAML/SSO, MFA, and identity integrations (Azure AD/Entra ID, Okta)
• Experience with Git, CI/CD, or infrastructure-as-code practices
• Prior experience in an enterprise or managed services environment

Work Environment

Fully virtual position. Requires reliable home internet and a quiet workspace. Occasional off-hours support may be needed during migration cutovers.