Senior Network Engineer - Firewall Engineering

Oak Ridge National Laboratory•Oak Ridge, TN

4d•Hybrid

About The Position

Oak Ridge National Laboratory (ORNL) is seeking a Senior Network Engineer to support unclassified operations. This role requires advanced knowledge of network engineering, firewall architecture, network security policy, enterprise network design, and complex information systems. The position focuses on the engineering, architecture, implementation, and lifecycle management of enterprise firewall services. The engineer will collaborate with various teams across the laboratory, including Enterprise Networking, Information Technology, the Classification Office, Cybersecurity, Laboratory Enterprise Risk, and Internal Audit. The goal is to develop secure, reliable, and scalable solutions that support the laboratory’s growth, improve service availability, operational efficiency, and enhance ORNL’s cybersecurity posture by evaluating technical and security requirements and developing enterprise-class network and firewall solutions. The position demands the ability to apply industry standards and government security requirements within ORNL’s environment, serving as a technical leader and subject-matter expert for firewall architecture.

Requirements

BS degree in computer science, information technology, cybersecurity, engineering, or a related discipline, with 8 years of professional experience. An equivalent combination of education and experience may be considered.
Significant experience designing, implementing, and supporting enterprise network and firewall environments.
Advanced hands-on experience with Next-Gen firewalls and centralized management.
Strong knowledge of TCP/IP, IPv4 and IPv6, subnetting, routing, switching, network segmentation, access control, NAT, VPN technologies, and high-availability design.
Knowledge of network-security architecture, defense-in-depth, least privilege, zero trust, and secure network-design principles.
Experience working within structured change-control, configuration-management, and incident-management processes.

Nice To Haves

Ability to prepare clear technical documentation and communicate effectively with technical and nontechnical stakeholders.
Ability to work independently, lead complex technical efforts, and collaborate effectively across organizational boundaries.
Experience with Palo Alto Networks technologies such as GlobalProtect, Advanced Threat Prevention, Advanced URL Filtering, WildFire, DNS Security, User-ID, App-ID, and SSL/TLS decryption.
Experience managing large or distributed Palo Alto firewall environments using Panorama templates, template stacks, device groups, and policy hierarchy.
Experience integrating firewalls with identity and authentication technologies such as Active Directory, LDAP, RADIUS, SAML, multifactor authentication, and certificate-based authentication.
Experience with network automation and configuration management using Python, PowerShell, Ansible, Terraform, REST APIs, or similar technologies.
Familiarity with public- or private-cloud networking and security, including Palo Alto VM-Series or cloud-native firewall integrations.
Experience working in a federal government, DOE, national laboratory, research, critical-infrastructure, or similarly regulated environment.
Familiarity with applicable security frameworks and guidance, including NIST publications, federal cybersecurity requirements, and security control assessment processes.
Relevant certifications such as Palo Alto Networks Certified Network Security Engineer, Palo Alto Networks Certified Network Security Architect, Cisco Certified Network Professional, or comparable credentials.

Responsibilities

Design, implement, maintain, and improve complex information systems that comply with U.S. Department of Energy (DOE), other applicable government, and local cybersecurity policies.
Evaluate how existing information systems integrate with one another and determine how new technologies can be securely incorporated into the enterprise environment.
Develop solutions that balance cybersecurity, availability, performance, maintainability, and mission requirements.
Design and maintain enterprise firewall architectures supporting campus, data center, internet-edge, remote-access, and segmented network environments.
Serve as a subject-matter expert for firewalls, firewall management, VPN clients, and associated security services.
Translate business, mission, technical, and cybersecurity requirements into secure firewall designs and implementation plans.
Lead firewall deployments, migrations, upgrades, hardware refreshes, policy conversions, and platform-standardization initiatives.
Troubleshoot complex connectivity, routing, application, performance, high-availability, and security-policy issues across multiple network and system layers.
Monitor firewall capacity, system health, software lifecycle status, security advisories, and emerging threats; recommend upgrades or architectural changes when appropriate.
Participate in scheduled maintenance activities and provide escalation or on-call support for critical network-security services as required.
Deliver ORNL’s mission by aligning behaviors, priorities, and interactions with our core values of Impact, Integrity, Teamwork, Safety, and Service. Promote equal opportunity by fostering a respectful workplace – in how we treat one another, work together, and measure success.