Network Security Engineer - Palo Alto Next Gen Firewall (SC Cleared) Mid-level role within the Security Support team responsible for maintaining the availability, security, and operational health of the enterprise network security estate, focusing on firewalls and SASE services. Key Responsibilities * Operations & Service Management: Support security infrastructure and firewalls following ITIL practices (incident, request, problem, change management). * Incident & Issue Ownership: Methodically triage, diagnose, remediate, and close incidents; escalate with evidence when needed. * Change Delivery: Translate requirements into support actions and execute controlled production changes with peer review, testing, and rollback plans. * Problem Management: Perform root-cause analysis on recurring issues and implement preventative solutions. * Vendor & Team Coordination: Manage technical escalations with vendors, MSPs, and internal cross-functional IT/security teams. * Documentation & Governance: Maintain configurations, asset records, runbooks, and diagrams; apply least-privilege principles and audit compliance in a regulated environment. Technical Requirements * Networking & Protocols: Strong knowledge of TCP/IP, DNS, DHCP, NAT, TLS, HTTP/S, static/dynamic routing (BGP, OSPF), VRFs, and segmentation. * Firewall & Security Administration: Hands-on experience with enterprise NGFWs (policy, NAT, VPNs, security profiles) and lifecycle management (upgrades, patching, rule recertification). * Troubleshooting: Advanced diagnosis using PCAPs, logs, and monitoring tools for asymmetric routing, MTU, authentication, and application connectivity issues. * Preferred Platforms: Palo Alto / Fortinet (Panorama, FortiManager, FortiAnalyzer), SASE solutions, and F5 (or equivalent load balancers). * Desirable: AWS/Azure networking, vulnerability management (Tenable), email security (Mimecast), basic scripting/automation (Python, PowerShell, APIs), and ITIL or vendor certifications (PCNSE, NSE, CCNA/CCNP). Working Conditions * Shift Rota: Coverage between 08:00 and 18:00, with occasional out-of-hours maintenance as required. * Clearance: Security Check (SC) clearance required