Firewall Engineer III

RISA•Springfield, VA

5d•$117,000 - $128,000•Onsite

About The Position

RISA is hiring a Palo Alto SME to serve as the focal point for Palo Alto tasks, operations, and projects on the Network Security Services team supporting an Intelligence Community customer. The role is based onsite in Springfield, Virginia, and spans legacy PA-3000 and PA-5000 hardware and CLI through Prisma Access, VM-Series, Panorama, and Cortex. The engineer will serve as the lead technical authority for Palo Alto firewalls across a hybrid enterprise, lead secure network architecture work, manage platform lifecycles and upgrades, centralize policy management, own configuration processes, mentor junior engineers, and liaise with contract, customer, and government DAA stakeholders. The position requires an active TS/SCI clearance, U.S. citizenship, and the ability to obtain and maintain a U.S. Government polygraph. Travel is up to 15%, local and CONUS. Compensation is $117,000–$128,000. The role is full-time and exempt.

Requirements

U.S. citizenship and an active TS/SCI clearance.
Ability to obtain and maintain a U.S. Government polygraph.
Meet contract labor category education and experience criteria: bachelor's degree in an applicable field plus 6 years of relevant experience; alternatively, master's degree plus 4 years, associate degree plus 8 years, or high school diploma/GED plus 10 years.
At least 7 years of hands-on experience administering, configuring, and troubleshooting Palo Alto NGFWs in large-scale enterprise or global environments.
Active PCNSE certification.
DoD 8140.01 and 8570.01-M IAT Level II certification (e.g., Security+ CE), and CSSP Infrastructure Support certification within 120 days of start.
Deep practical knowledge of legacy Gen 2/Gen 3 hardware, including PA-3000 and PA-5000 series, legacy CLI, physical troubleshooting, and line-card replacement.
Experience with Prisma Access (SASE), Prisma SD-WAN, and VM-Series in AWS, Azure, or GCP.
Knowledge of Panorama template and device-group inheritance across a hybrid fleet.
Advanced knowledge of BGP, OSPF, IPSec VPN, and NAT.

Nice To Haves

PCNSC or Prisma Certified SASE Professional (PCSAE).
Python and firewall automation with Ansible, Terraform, or Palo Alto XML/REST APIs.
Cortex XDR or XSOAR; Expedition for legacy rule migration to App-ID policy.
Zero Trust Network Access architecture; experience with F5 (APM, AFM), Juniper SRX, or Cisco FTD/ASA.

Responsibilities

Serve as the lead technical authority for administering, configuring, and troubleshooting Palo Alto NGFWs across a hybrid enterprise.
Lead the design, analysis, testing, and implementation of secure network architectures on the Palo Alto stack.
Manage the full hardware and software lifecycle, including complex refreshes and PAN-OS upgrades on legacy platforms.
Run Panorama for centralized policy management across physical and virtual firewalls.
Configure security profiles, including App-ID, User-ID, Content-ID, SSL Decryption, and WildFire.
Own configuration management processes and SOPs for Palo Alto platforms.
Mentor junior engineers and act as the escalation point for complex troubleshooting.
Liaise with contract, customer, and government DAA stakeholders regarding network security status, policies, and procedures.