Palo Alto Firewall Engineer - L2

Key Responsibilities

• Engineer, administer and improve Palo Alto firewall platforms, Panorama and relevant cloud-managed capabilities across a complex global environment.
• Own advanced diagnosis and resolution of complex firewall, routing, NAT, App-ID, DNS, VPN and connectivity issues, including technical leadership during significant incidents.
• Assess and deliver non-standard or higher-risk firewall changes, confirming design alignment, security impact, dependencies, testing, evidence and rollback readiness.
• Lead root-cause analysis for recurring or high-impact incidents and implement corrective and preventive actions that reduce recurrence and operational risk.
• Plan and execute controlled patching, software upgrades, lifecycle activity and configuration change, including validation and operational handover.
• Drive rule recertification, policy optimisation, object hygiene, segmentation and Zero Trust policy-improvement initiatives.
• Develop reusable automation using REST APIs, Python, Ansible, Terraform or comparable approved technologies, moving suitable activities toward API-first and Infrastructure-as-Code delivery.
• Contribute to the evolution of policy-as-code practices, automated compliance validation and repeatable engineering pipelines with appropriate governance.
• Use service telemetry and operational analytics to identify configuration drift, policy anomalies, recurring demand, capacity risks and technical debt.
• Improve platform observability, engineering standards, technical documentation and reusable implementation patterns.
• Partner with platform owners, Cyber Security, architecture, Network Operations, cloud teams, application teams and suppliers on roadmap, resilience and transformation priorities.
• Coach Level 1 engineers, raise troubleshooting and documentation standards, and support progression into broader engineering ownership.
• Provide follow-the-sun engineering support and technical leadership during complex incidents, high-risk implementations and service-recovery activity.

AI Expectations - Engineering Tier

• Use approved AI-enabled capabilities as an embedded part of troubleshooting, knowledge retrieval, documentation, operational analysis and continuous improvement.
• Validate AI-assisted recommendations before use and retain clear human accountability for every firewall decision, approval and production change.
• Identify repeatable activities that can be simplified or automated, maintaining testing, approval, auditability, security and rollback controls.
• Protect confidential and enterprise data by following requirements for secure, responsible and transparent use of

AI.

• Demonstrate measurable improvement in service quality, engineering productivity, operational resilience or reduction of manual effort.
• Apply AI-assisted analysis to detect policy anomalies, recurring incidents, configuration drift and optimisation opportunities, validating all findings technically.
• Translate repeatable operational knowledge into controlled workflows, engineering playbooks and automation candidates.

Skills & Experience

• Demonstrated experience engineering and supporting Palo Alto Networks firewalls in a complex enterprise environment.
• Hands-on expertise with Panorama; exposure to Strata Cloud Manager or comparable cloud-managed firewall capabilities is advantageous.
• Strong knowledge of TCP/IP, routing, segmentation, NAT, App-ID, security policy, DNS and site-to-site or remote-access VPN technologies.
• Proven ability to troubleshoot complex firewall and connectivity issues using logs, packet captures, traffic analysis and monitoring tools.
• Experience assessing and implementing controlled production changes and supporting Incident, Change and Problem Management processes.
• Experience with policy review, rule recertification, optimisation, vulnerability remediation, configuration compliance and control evidence.
• Practical scripting or automation experience using Python, REST APIs, Ansible, Terraform or comparable technologies.
• Understanding of Infrastructure-as-Code, version control and API-first engineering concepts; practical exposure is advantageous.
• Familiarity with Azure or AWS network security and hybrid connectivity is advantageous.
• Ability to lead technical investigation, communicate risk clearly, mentor colleagues and influence global stakeholders.
• A relevant degree or equivalent practical experience; PCNSE, CCNP Security, CISSP or a comparable certification is advantageous.