Intermediate Firewall Engineer

Chenega Corporation • Oakton, VA

6d • Onsite

About The Position

The Intermediate Firewall Engineer is based in Oakton, Virginia, and is responsible for engineering, administering, and maintaining enterprise boundary-defense platforms and network security appliances. The role serves as a Tier 2/3 escalation and implementation lead, translating architectural designs into secure firewall configurations across on-premises and classified mission enclaves, including DMSS, Secret/SAP, and TS/SCI/SAP environments. The engineer supports strategic engineering initiatives as well as day-to-day operations, resolves escalations from junior staff, and provides operational support to the Senior Firewall Engineer.

The role centers on Palo Alto Networks firewalls managed through Panorama, Site-to-Site IPsec VPNs, dynamic routing, scheduled PAN-OS maintenance, and continued compliance with DISA STIGs and DoD change-management standards. The engineer also supports security operations, compliance documentation, remote sites, and technical mentorship for junior engineers.

Requirements

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field and at least 4 years of hands-on network security/firewall engineering experience; alternatively, a high school diploma or GED and at least 8 years of demonstrable operational experience in lieu of a degree.
• Meet DoD 8140 / 8570.01-M IAT Level II baseline certification requirements, such as CompTIA Security+ CE, CCNA Security, or CySA+.
• Palo Alto Networks Certified Network Security Administrator (PCNSA) certification.
• Active Secret security clearance and eligibility to obtain TS/SCI/SAP.
• Strong operational knowledge of Palo Alto Networks NGFW administration, Panorama centralized management, and PAN-OS features including App-ID, Content-ID, and User-ID.
• Experience building, troubleshooting, and tuning Site-to-Site IPsec VPN tunnels, GlobalProtect remote access gateways, and dynamic NAT/PAT policies.
• Working knowledge of BGP, OSPF, static routing, subnetting, and Layer 2/3 switching fabrics.
• Practical understanding of DoD RMF, DISA STIG validation, and boundary-protection compliance checklists.
• Experience integrating firewall telemetry and syslog forwarding with SIEM/SOAR platforms and network visibility fabrics.
• Analytical and packet-level troubleshooting skills using tools such as Wireshark, TCPdump, and Panorama traffic/threat inspection logs.
• Familiarity with ITSM workflows, configuration change-management boards, and tracking platforms such as Jira, ServiceNow, and Redmine.

Nice To Haves

• Palo Alto Networks Certified Network Security Engineer (PCNSE) certification.
• Experience with SIEM/SOAR platforms including Splunk, Cribl, and XSOAR.
• Experience with network visibility fabrics such as IXIA Packet Brokers.

Responsibilities

• Administer, configure, and maintain Palo Alto Networks Next-Generation Firewalls using Panorama and direct management interfaces in accordance with change-control protocols.
• Provision security policies, App-ID rules, TLS/SSL decryption policies, dynamic NAT/PAT schemes, and standardized security objects across multi-tenant environments.
• Investigate and resolve complex network connectivity failures, IPsec VPN tunnel drops, routing anomalies, and application performance issues as a Tier 2/3 escalation point.
• Implement BGP and OSPF routing, VLAN segmentation, and perimeter access controls across mission partner enclaves.
• Manage remote sites and external stakeholders across classified networks, including establishing, monitoring, and maintaining IPsec tunnels, VPN gateways, and operational telemetry.
• Plan, coordinate, and execute PAN-OS maintenance updates, dynamic threat content releases, antivirus definition updates, and security patches under senior engineering direction.
• Execute DISA STIG checklists, remediate vulnerability scan findings, and update PO&AM documentation to maintain ATO and security baselines.
• Support SOC incident isolation, validate security telemetry log-forwarding pipelines, and isolate traffic anomalies during cyber events.
• Maintain configuration records, network topology diagrams, change audit logs, and SOPs in ticketing and project systems such as Redmine and Jira.
• Mentor Junior Firewall Engineers, review routine change requests, and assist with complex troubleshooting.
• Perform other duties as assigned.

Benefits

• Broad range of benefits is offered, but specific benefits are not listed.
• Well-being programs.
• Professional development opportunities, including on-the-job learning and formal development programs.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level