Note: The job is a remote job and is open to candidates in USA. Hasbro and Wizards of the Coast create entertainment experiences and games that connect people through play and imagination. They are seeking a Principal Network Engineer to serve as the technical lead for enterprise network transformation, owning Zero Trust Network Access architecture, Palo Alto Panorama, cloud networking integration, identity-based enforcement, and global network engineering standards.
Responsibilities
- Act as the technical expert for the Network 2.0 ZTNA program — own the architecture, lead design reviews, establish engineering standards, and address any critical issues during implementation
- Build and validate the full ZTNA architecture across all primary and international sites — defining network zones, segmentation policy, and device posture requirements that eliminate lateral movement risk
- Own Palo Alto Panorama at the platform level — template hierarchy, device group build, policy push governance, and configuration drift elimination across all on-premises and cloud-connected NGFWs
- Develop the AWS and Palo Alto Panorama cloud integration — specifying how cloud-native firewall policy, VPC topology, and on-premises ZTNA fabric come together within a unified enforcement plane
- Lead the Palo Alto Cloud Identity Engine (CIE) architecture (Year 2, joint with IAM): build the identity-to-network enforcement model, author the network zone taxonomy, and own the IP-to-identity rule migration that eliminates all IP-based user firewall rules
- Guide GlobalProtect architecture choices — agent setup, split tunneling policy, certificate trust chain, and version compliance standards maintained through Intune
- Author and maintain the network architecture documentation, build decision records, and runbook library that the broader team completes tasks from — you write the standard; the team operates to it
- Lead the global site topology mapping effort by detailing all international sites. Define the tiered support model and produce the hardware refresh sequencing plan linked to the ZTNA rollout waves
- Partner with the Automation / Network Reliability Engineer to build self-healing policy frameworks, Panorama API automation patterns, and CI/CD pipeline standards for network configuration changes
- Represent Network Engineering in cross-functional architecture reviews alongside IAM, Cloud Infrastructure, Security, and Central Technology — you are the network perspective in discussions where enterprise architecture is determined
Skills
- 10+ years of enterprise network engineering with demonstrated depth in large-scale architecture building — not just operations
- Expert-level Palo Alto NGFW and Panorama proficiency — template hierarchy, device groups, security policy development, NAT, decryption policy, and multi-vsys environments
- Proven ZTNA architecture experience — you have built a ZTNA deployment, not just configured one; you understand the segmentation model, the policy logic, and the failure modes
- Extensive understanding of GlobalProtect — including agent architecture, gateway setup, certificate trust, split tunneling policy, and diagnosing issues across various endpoint types at scale
- AWS network architecture hands-on — VPC build, Transit Gateway, Direct Connect, AWS Network Firewall, and cloud-native connectivity patterns that integrate with on-premises enforcement
- Understanding of identity-to-network enforcement patterns — how identity signals (Okta groups, Entra device compliance, CIE) translate into firewall policy and how that architecture scales
- Grasp of SD-WAN concepts and Prisma SD-WAN or equivalent — intelligent path selection, application-aware routing, and WAN optimization in a multi-site enterprise
- Experience authoring network architecture documentation, design decision records, and engineering standards that other engineers can develop against with confidence
- Ability to function as a trusted individual contributor alongside a senior manager — you develop the technical depth so the manager can handle the program; you do not require micromanagement and you do not generate it
- Clear communicator across technical and non-technical audiences. You can explain a zone segmentation model to a CISO and a Panorama template hierarchy to a junior engineer in the same afternoon
- Practical experience with Palo Alto Cloud Identity Engine (CIE) — incorporating Okta or Entra group membership into NGFW policy enforcement
- Network automation depth — Python, Ansible, or Panorama API scripting for policy automation, compliance checking, or self-healing configurations
- Background in GCP network setup — VPC Service Controls, Cloud Armor, or hybrid connectivity patterns between GCP and on-premises ZTNA fabric
- Experience working in a multi-studio, multi-site entertainment or gaming enterprise with geographically distributed international infrastructure
- Active certifications: PCNSE (Palo Alto Certified Network Security Engineer), ZTNA specialist, or AWS Advanced Networking Specialty
Benefits
- Employees may also be eligible for annual and long-term incentives.
- Medical, Dental & Vision Insurance
- Paid Vacation Time & Holidays
- Generous 401(k) match
- Paid Parental Leave
- Volunteer Program
- Employee Giving & Matching Gifts Programs
- Tuition Reimbursement
- Product Discounts
Company Overview
Company H1B Sponsorship