Senior Network Firewall Engineer

Position: Senior Network Firewall Engineer Location: Remote (East Coast Preferred) Exp: 8+yrs Team: Network Security / VPN Services About the Role CBTS is hiring a Senior Network Firewall Engineer to join the VPN services team during a large-scale migration from Cisco AnyConnect to Palo Alto Prisma Access (GlobalProtect). Roughly 22,000 users have moved so far, with about 60,000 remaining [VERIFY]. You will help lead the engineering effort and build the automation that makes the migration repeatable and fast. This is a hands-on senior role: you will set technical direction for the team’s scripting and tooling, and you will still do the work yourself. Responsibilities Design, configure, and support Palo Alto Prisma Access and GlobalProtect VPN services Lead the technical execution of the phased migration of users and groups from Cisco AnyConnect to Palo Alto Design and develop Python and/or PowerShell automation for migration tasks, such as user and group onboarding, policy and configuration builds, validation checks, and reporting Automate recurring engineering tasks to reduce manual effort and errors Set standards for code quality, testing, and version control on the team’s automation Serve as an escalation point for complex connectivity, authentication, and policy issues Maintain firewall policies, security profiles, and configuration standards Mentor junior engineers and review their scripts and configurations Document designs, runbooks, and automation so the team can reuse them Partner with network, security, and service desk teams, and report on migration progress to stakeholders Required Qualifications 7+ years of experience in network or firewall engineering Deep hands-on experience with Palo Alto Networks firewalls (Panorama, GlobalProtect, or Prisma Access) Working knowledge of Cisco AnyConnect or ASA/FTD VPN Proficiency in Python and/or PowerShell, with a record of building automation used in production Strong understanding of TCP/IP, routing, NAT, SSL/IPsec VPN, and network security fundamentals Experience with REST APIs and scripting against network or security platforms Strong troubleshooting and written communication skills Preferred Qualifications Palo Alto certification (PCNSE preferred) Experience leading large-scale VPN or remote access migrations Familiarity with SAML/SSO, MFA, and identity integrations (Azure AD/Entra ID, Okta) Experience with Git, CI/CD, or infrastructure-as-code practices Prior experience in an enterprise or managed services environment Work Environment Fully virtual position. Requires reliable home internet and a quiet workspace. Occasional off-hours support may be needed during migration cutovers.