Intermediate Firewall Engineer

SecuriGence•Oakton, VA

6d•$119,700 - $140,000

About The Position

SecuriGence, part of Chenega Military, Intelligence & Operations Support (MIOS), is seeking an Intermediate Firewall Engineer in Oakton, Virginia. The engineer will handle core engineering, day-to-day administration, and operational maintenance of enterprise boundary-defense platforms and network security appliances. The role serves as a Tier 2/3 escalation and implementation lead, translating architectural designs into secure firewall configurations across on-premises and classified mission enclaves, including DMSS, Secret/SAP, and TS/SCI/SAP environments. The engineer manages Palo Alto Networks firewalls through Panorama, troubleshoots Site-to-Site IPsec VPNs, administers BGP and OSPF routing, coordinates PAN-OS software updates, and maintains compliance with DISA STIGs and DoD change-management standards. The position bridges engineering initiatives and routine operational support, resolving escalations for junior staff and supporting the Senior Firewall Engineer. The role also includes supporting ATO and security baselines, assisting the SOC with incident isolation, maintaining technical records and operational procedures, and mentoring Junior Firewall Engineers. The posting describes professional-development opportunities through hands-on learning and formal development programs, as well as a supportive culture and well-being programs.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field and 4 or more years of hands-on network security/firewall engineering experience; alternatively, a high school diploma or GED and 8 or more years of demonstrable operational experience in lieu of a degree.
Meet DoD 8140 / 8570.01-M IAT Level II baseline certification requirements, such as CompTIA Security+ CE, CCNA Security, or CySA+.
Palo Alto Networks Certified Network Security Administrator (PCNSA) certification.
Active Secret security clearance with eligibility to obtain TS/SCI/SAP.
Strong operational knowledge of Palo Alto Networks NGFW administration, Panorama centralized management, and PAN-OS features including App-ID, Content-ID, and User-ID.
Experience building, troubleshooting, and tuning Site-to-Site IPsec VPN tunnels, GlobalProtect remote-access gateways, and dynamic NAT/PAT policies.
Working knowledge of BGP, OSPF, static routing, subnetting, and Layer 2/3 switching fabrics.
Practical understanding of DoD RMF, DISA STIG validation, and boundary-protection compliance checklists.
Experience integrating firewall telemetry and syslog forwarding with SIEM/SOAR platforms such as Splunk, Cribl, or XSOAR, and network visibility fabrics such as IXIA Packet Brokers.
Analytical and packet-level troubleshooting skills using tools such as Wireshark, TCPdump, and Panorama traffic/threat inspection logs.
Familiarity with ITSM workflows, configuration change-management boards (CCB), and tracking platforms such as Jira, ServiceNow, or Redmine.

Nice To Haves

Palo Alto Networks Certified Network Security Engineer (PCNSE) certification.

Responsibilities

Administer, configure, and maintain Palo Alto Networks Next-Generation Firewalls through Panorama and direct management interfaces in accordance with change-control protocols.
Provision and deploy security policies, App-ID rules, TLS/SSL decryption policies, dynamic NAT/PAT schemes, and standardized security objects across multi-tenant environments.
Serve as a Tier 2/3 operational escalation point, resolving complex connectivity failures, IPsec VPN tunnel drops, routing anomalies, and application performance bottlenecks.
Implement BGP and OSPF, VLAN segmentation, and perimeter access controls to maintain resilient connectivity and segmentation across mission partner enclaves.
Lead remote site management for performers and external stakeholders across classified networks, including establishing, monitoring, and maintaining IPsec tunnels, VPN gateways, and operational telemetry.
Plan, coordinate, and execute scheduled PAN-OS maintenance updates, dynamic threat-content releases, antivirus definition updates, and security patches under senior engineering leads.
Maintain ATO and security posture baselines by executing DISA STIG checklists, remediating vulnerability scan findings, and updating PO&AM documentation.
Support incident isolation for the SOC by validating security telemetry log-forwarding pipelines and isolating traffic anomalies during cyber events.
Maintain configuration records, network topology diagrams, change audit logs, and operational SOPs in ticketing and project systems such as Redmine and Jira.
Mentor Junior Firewall Engineers, review routine change requests, and assist with complex troubleshooting workflows.
Perform other duties as assigned.