Senior Network Engineer

Senior Network Engineer (ZeroTrust, Palo Alto VPN)Senior Network Engineer needed to help optimize or redesign the VPN user group hierarchy to implement Zero Trust for the VPN that is managed by our Palo Alto Firewall with strong cybersecurity mindset to support the design, configuration, and implementation of Zero Trust networking, starting with VPN access using Palo Alto Networks technologies. This role is initially focused on transforming our VPN environment from a traditional network-based model to an identity- and role-based Zero Trust access model. For the right candidate, the role will expand into additional security and network architecture areas over time. The ideal candidate is hands-on, security-focused, and comfortable working closely with cybersecurity and infrastructure teams in a regulated, audit-conscious environment.Zero Trust & VPN EngineeringDesign and configure Palo Alto Networks VPN solutions to support Zero Trust principlesImplement least-privilege VPN access, where users can only access systems required for their roleDefine and enforce user- and group-based access policies rather than broad network accessPartner with cybersecurity leadership to align VPN controls with Zero Trust strategyNetwork Security & VisibilitySupport network segmentation and secure access to sensitive systems (e.g., admin and infrastructure services)Ensure configurations are fully auditable and defensible for future compliance reviewsForensics & Access ContextUse AlienVault and Palo Alto to: Analyze VPN traffic and user activityIdentify systems and applications accessed by ~ 100 VPN users for this engagementSupport forensic investigations related to VPN accessProvide actionable insights to help: Build a VPN access context based on VPN traffic analysis of the 100 usersAssign users to the correct VPN groups as part of the Zero Trust initiativeCollaboration & CommunicationWork closely with: The IT Architecture teamThe Cybersecurity teamClearly communicate technical findings, access models, and design decisionsParticipate in design reviews, scoping discussions, and implementation planningQualificationsAbility to work onsite in San Jose, CASenior-level experience in network security engineeringStrong hands-on experience with Palo Alto Networks firewalls and VPNDemonstrated understanding of Zero Trust networking conceptsExperience implementing identity-based and role-based access controlsHands-on experience with utilizing SIEM (AlienVault preferred) for logging, analysis, and forensic investigationsStrong troubleshooting and analytical skillsAbility to communicate effectively with highly technical teamsIndividual compensation is determined by skills, qualifications, experience, and location. Compensation details listed in this posting reflect the base hourly rate or annual salary only, unless otherwise stated. In addition to base compensation, full-time roles are eligible for Medical, Dental, Vision, Commuter and 401K benefits with company matching.