Senior Network Security Engineer

Applied Materials•Santa Clara, CA

4d•Onsite

About The Position

The Senior Network Security Engineer is a hands-on technical leader responsible for designing, implementing, securing, and operating enterprise firewall and network security infrastructure across data centers, manufacturing, OT, R&D, campus, and cloud environments. The role primarily focuses on Palo Alto Networks firewall architecture, engineering, policy governance, lifecycle management, and security posture optimization, with supporting expertise in Fortinet, SSE/SASE, Zero Trust, cloud security, routing, and security automation. The engineer partners with cybersecurity, cloud, network, OT, application, and infrastructure teams to deliver secure, resilient, scalable, and standardized network security services across Applied Materials’ global environments. The role provides technical leadership on complex initiatives, establishes engineering standards, supports incident response and compliance activities, and influences architecture and technology direction. The position is based in Santa Clara, California. The listed salary range is $152,000–$208,500. Travel is required approximately 10% of the time, and the position is not relocation eligible. The role is full-time and regular. A bachelor’s degree in Computer Science, Engineering, Information Technology, Cybersecurity, or a related field is required, along with 8–12 years of relevant experience. Highly preferred certifications include Palo Alto Networks PCNSE and CISSP.

Requirements

8+ years of enterprise Network Security Engineering experience; the education and experience section specifies 8–12 years of relevant network and network security engineering experience.
5+ years of hands-on Palo Alto Networks experience in architecture, deployment, engineering, or advanced operations.
Expert knowledge of PAN-OS, Panorama, App-ID, User-ID, NAT, SSL decryption, Security Profiles, Threat Prevention, VPN, and security-policy management.
Strong experience with enterprise firewall architecture, policy governance, and lifecycle management.
Expert knowledge of TCP/IP, BGP, OSPF, routing, VPN, and network segmentation.
Advanced firewall troubleshooting and packet-analysis capabilities.
Experience designing secure, highly available network architectures.
Experience with enterprise cloud and hybrid-cloud environments.
Experience leading complex infrastructure or security projects.
Strong analytical, documentation, communication, and stakeholder-management skills.
Bachelor’s degree in Computer Science, Engineering, Information Technology, Cybersecurity, or a related field.
Ability to independently solve complex Layer 3 through Layer 7 security problems and provide technical leadership to other engineers.
Highly preferred certifications: Palo Alto Networks PCNSE and CISSP.

Nice To Haves

Experience with Fortinet FortiGate, FortiManager, and FortiAnalyzer.
Experience with Strata Cloud Manager, Palo Alto AIOps/BPA, Skybox, or Tufin.
Experience deploying firewalls in Azure, AWS, and/or GCP.
Experience with Prisma Access and/or Zscaler ZIA/ZPA.
Experience with SIEM/XDR/SOAR integrations.
Experience with OT/manufacturing network security and segmentation.
Experience within large-scale, globally distributed enterprise environments.
Preferred or additional certifications: CCNP Security, CCIE Security, Fortinet certifications, Zscaler certifications, Microsoft Azure networking/security certifications, and AWS Advanced Networking/Security certifications.

Responsibilities

Design, implement, and support global Palo Alto Networks firewall infrastructure, including PA-Series, VM-Series, Panorama, and Strata Cloud Manager.
Design resilient firewall architectures across data center, campus, manufacturing, OT, R&D, and cloud environments; define reference architectures, configuration standards, security baselines, and deployment patterns.
Engineer high availability, routing, NAT, VPN, segmentation, PBF, ECMP, VSYS, virtual routing, and multi-tenancy architectures; define Panorama device-group, template, and template-stack architectures; support Fortinet infrastructure where required.
Architect and govern enterprise firewall rule structures, policy hierarchy, objects, naming standards, and policy lifecycle processes.
Optimize firewall rule bases and lead migrations from port-based policies to application- and identity-based policies.
Design and implement App-ID, User-ID, Device-ID, Security Profiles, SSL/TLS decryption, IPS, Advanced Threat Prevention, DNS Security, URL Filtering, and WildFire controls.
Reduce unused, duplicate, shadowed, overly permissive, and high-risk firewall policies; establish policy recertification, ownership, change-control, and compliance processes.
Review configurations and security posture using SCM, Palo Alto BPA/AIOps, Skybox, Tufin, and CIS benchmarks.
Own PAN-OS and FortiOS lifecycle management, including upgrades, hardware refreshes, vulnerability remediation, capacity planning, and performance optimization.
Troubleshoot complex firewall, routing, NAT, VPN, decryption, application, and connectivity issues; perform packet captures, session analysis, flow diagnostics, and root-cause analysis.
Serve as a senior escalation point for critical network security incidents and infrastructure outages; develop operational standards, runbooks, health checks, KPIs, and engineering documentation.
Design and support SSE/SASE architectures using Prisma Access and Zscaler ZIA/ZPA; engineer SWG, CASB, ZTNA, DLP, Remote Browser Isolation, private application access, and cloud-delivered security controls.
Support secure remote access for employees, contractors, and third parties using identity, device posture, and Zero Trust principles; integrate platforms with Microsoft Entra ID, Okta, SAML, SCIM, Cloud Identity Engine, EDR, and device-posture services.
Support modernization and replacement of legacy VPN architectures with ZTNA where appropriate.
Architect network security across Azure, AWS, and GCP; design and operate Palo Alto VM-Series and Cloud NGFW deployments; secure hybrid-cloud traffic and implement segmentation and Zero Trust controls.
Partner with cloud teams to integrate firewall services with cloud-native routing, security groups, load balancers, DNS, and identity services.
Integrate firewall telemetry with SIEM/XDR/SOAR platforms; engineer logging and telemetry using Syslog, CEF, APIs, and cloud integrations.
Support security investigations, incident containment, threat analysis, and remediation; partner with Security Operations to improve firewall-based detection and response; develop monitoring, dashboards, alerts, and operational security metrics.
Lead global initiatives such as firewall modernization, segmentation, data center migrations, cloud security transformation, SSE/SASE adoption, and Zero Trust programs.
Develop high- and low-level designs, implementation and test plans, migration and rollback plans, and operational runbooks; lead projects from architecture through implementation and operational handoff.
Evaluate new technologies, lead proof-of-concepts, provide platform recommendations, mentor engineers, and establish technical standards and best practices.
Present architecture, risk, project status, and technology recommendations to IT and cybersecurity leadership.
Ensure firewall and network security controls align with corporate requirements and frameworks including NIST CSF, ISO 27001, CIS Controls, and applicable export-control requirements.
Lead firewall rule recertification, configuration audits, security assessments, and vulnerability remediation; document risks and drive remediation with stakeholders; maintain auditable standards, baselines, and security-control documentation.