Palo Alto Firewall Engineer / SME (PCNSE)

RISA•Springfield, VA

2d•Onsite

About The Position

RISA is hiring a Palo Alto subject-matter expert to serve as the focal point for Palo Alto tasks, operations, and projects on the Network Security Services team supporting an Intelligence Community customer. The work covers legacy PA-3000 and PA-5000 hardware and CLI as well as Prisma Access, VM-Series, Panorama, and Cortex. The position is onsite in Springfield, Virginia, with travel of up to 15% locally and within the continental United States. An active TS/SCI clearance and U.S. citizenship are required to start; the employee must also be able to obtain and maintain a U.S. Government polygraph. The engineer will be the lead technical authority for Palo Alto next-generation firewalls across a hybrid enterprise. The role includes designing and implementing secure network architectures, managing hardware and software lifecycles, operating Panorama for centralized policy management, and owning configuration management processes and standard operating procedures. The engineer will also mentor junior staff, resolve escalated technical issues, and coordinate with contract, customer, and government DAA stakeholders. This is a full-time, exempt position. The stated salary range is $117,000–$128,000.

Requirements

U.S. citizenship and an active TS/SCI clearance.
Ability to obtain and maintain a U.S. Government polygraph.
A bachelor's degree in a field applicable to the position plus 6 years of relevant experience, or an accepted equivalent: master's degree plus 4 years, associate degree plus 8 years, or high school diploma/GED plus 10 years.
7+ years of hands-on experience administering, configuring, and troubleshooting Palo Alto NGFWs in large-scale enterprise or global environments.
Active PCNSE certification.
DoD 8140.01 and 8570.01-M IAT Level II certification (e.g., Security+ CE), and CSSP Infrastructure Support within 120 days of start.
Practical knowledge of legacy Gen 2/Gen 3 PA-3000 and PA-5000 hardware, legacy CLI, physical troubleshooting, and line-card replacement.
Experience with Prisma Access (SASE), Prisma SD-WAN, and VM-Series in AWS, Azure, or GCP.
Experience with Panorama template and device-group inheritance across a hybrid fleet.
Advanced knowledge of BGP, OSPF, IPSec VPN, and NAT.

Nice To Haves

PCNSC or Prisma Certified SASE Professional (PCSAE).
Python and firewall automation using Ansible, Terraform, or Palo Alto XML/REST APIs.
Cortex XDR or XSOAR experience; Expedition for legacy rule migration to App-ID policy.
Zero Trust Network Access architecture experience.
Experience with F5 (APM, AFM), Juniper SRX, or Cisco FTD/ASA.

Responsibilities

Serve as the lead technical authority for administering, configuring, and troubleshooting Palo Alto NGFWs across a hybrid enterprise.
Lead the design, analysis, testing, and implementation of secure network architectures on the Palo Alto stack.
Manage the full hardware and software lifecycle, including complex refreshes and PAN-OS upgrades on legacy platforms.
Run Panorama for centralized policy management across physical and virtual firewalls.
Configure security profiles including App-ID, User-ID, Content-ID, SSL Decryption, and WildFire.
Own configuration management processes and SOPs for Palo Alto platforms.
Mentor junior engineers and serve as the escalation point for complex troubleshooting.
Liaise with contract, customer, and government DAA stakeholders on network security status, policies, and procedures.