10+ years of expert-level Palo Alto Networks experience in large enterprises with complex environments.
Hands-on experience with PA-7500, PA-5450, or PA-3000 series firewalls.
10+ years of enterprise cybersecurity assessments, including firewall architecture and configuration reviews.
Experience with large firewall migrations involving at least 5 HA pairs (10 firewalls).
10+ years of applying Palo Alto Networks best practices using native tools like Panorama.
10+ years of technical documentation writing and training experience.
3+ years with advanced Palo Alto Networks services, including Advanced Threat Prevention.
Responsibilities
Assess current and planned Palo Alto Networks architecture and NGFW configurations.
Build migration strategies and implementation plans for the new firewall setup.
Configure firewalls and validate failover for high availability.
Run functional and performance testing during migration.
Apply Palo Alto Networks best practices to security policies and monitoring.
Deliver as-built documentation and lead knowledge-transfer sessions for staff.
Benefits
Opportunity to work on a high-profile project at a major international airport.
Engagement in a cutting-edge Next-Generation Network program.
Collaboration with diverse teams across network, security, and project management.
Potential for professional growth in a dynamic environment.
Hands-on experience with advanced security technologies.
Full Job Description
Cornerstone is hiring an expert-level Palo Alto Networks Security Engineer for a two-year, full-time consulting engagement at a major international airport in the San Francisco Bay Area.
About the role The airport is modernizing its network as part of a Next-Generation Network program. The program includes a 400 Gbps backbone and a new Palo Alto Networks Next-Generation Firewall (NGFW) architecture. This architecture segments the airport's airline, concession, enterprise, and critical operations networks. You will lead the security side of this work. You will assess the current firewall setup, check the new design, run the migration, set up monitoring, and train the airport's staff to run the new system. You will work closely with network, security, and project management teams.
Key responsibilities Assessment
Assess the current and planned Palo Alto Networks architecture, NGFW configurations, and Next-Generation Internet Edge design.
Review Panorama and firewall baselines, including interfaces, zones, routing, and high-availability (HA) design.
Write findings, gap and risk analyses, and remediation recommendations.
Migration
Build migration strategies, implementation plans, and test plans.
Clean up existing configurations and migrate firewall rules and policies to the new environment.
Configure firewalls, Panorama, security zones, segmentation, and HA, and validate failover.
Run functional, failover, performance, and connectivity testing.
Support cutovers, including after-hours work when needed.
Track risks, issues, and dependencies, and support change management. Submit weekly status reports.
Best practices and monitoring
Apply Palo Alto Networks best practices to policies, profiles, and threat prevention.
Set up dashboards, alerts, and weekly and monthly reports using native tools such as Panorama, Strata Cloud Manager, and Strata Logging Service.
Configure historical trending and performance analysis.
Troubleshoot issues and open and escalate tickets with Palo Alto Networks.
Documentation and knowledge transfer
Deliver as-built documentation and standard operating procedures (SOPs).
Lead knowledge-transfer sessions for airport staff.
Required qualifications
10+ years of expert-level Palo Alto Networks experience in large enterprises. This means campuses with 5 or more locations and 20,000 or more users. Your work must cover design, assessment, setup, migration, and ongoing support of NGFWs and Panorama. It must include HA deployments, firewalls with more than 10G of throughput, and multi-zone environments with 1,000 or more policies.
Hands-on experience with PA-7500, PA-5450, or PA-3000 series firewalls (or equivalent platforms).
10+ years of enterprise cybersecurity assessments. This includes firewall architecture and configuration reviews, policy reviews, threat-prevention checks, and gap, vulnerability, and risk analysis.
Large firewall migrations of at least 5 HA pairs (10 firewalls) in one program. This includes config cleanup, policy translation, failover testing, end-to-end validation, and production cutovers. It also includes status reporting and change management.
10+ years of applying Palo Alto Networks best practices. This includes monitoring, alerts, dashboards, reporting, and trend analysis using native Palo Alto Networks tools such as Panorama and its logging tools, not third-party tools.
10+ years of writing technical documentation (as-builts, SOPs, troubleshooting guides) and training network and operations teams.
3+ years with advanced Palo Alto Networks services, including Advanced Threat Prevention, Prisma Access, Prisma Cloud, and related management and reporting tools.
Ability to pass an airport security background check and badging process.
Preferred qualifications
Palo Alto Networks certifications, such as PCNSE.
Experience with Prisma SD-WAN, Prisma Access, and SASE deployments.
Experience with Strata Cloud Manager and Strata Logging Service.
Experience in airports, transportation, critical infrastructure, or the public sector.
