Network Security Engineer (Denver)

Network Security Engineer — Juniper to Palo Alto Migration

Enterprise Engineering (EE) — Customer Migration Engagement

Location: Denver, CO (hybrid — 3 days onsite / 2 days remote)

Role Description (Job Summary)

We are seeking an experienced Network Security Engineer to support a customer team migrating from Juniper SRX to Palo Alto Networks Next-Generation Firewalls (NGFW). This is a hybrid engagement based in the Denver area, requiring three days per week onsite at the customer location and two days remote.

The ideal candidate has hands-on experience performing Juniper-to-Palo Alto migrations and can translate legacy Juniper configurations into Palo Alto best practices, while operating confidently in large-scale, service provider-grade environments.

Your Impact (Responsibilities)

• Lead and support the migration of firewall infrastructure from Juniper SRX to Palo Alto NGFW
• Translate existing Juniper configurations into Palo Alto best-practice architectures
• Redesign legacy port/protocol-based security policies into application-aware security policies
• Configure and operate Security Policies, NAT Policies, Application-ID, User-ID, Content-ID, and Zone-Based Security
• Integrate Palo Alto firewalls into complex service provider routing environments, including MPLS, EVPN/VXLAN, and large-scale IP transit architectures
• Deploy Palo Alto NGFWs in active/passive and active/active high availability architectures
• Implement advanced threat prevention capabilities, including IPS, Anti-Malware, URL Filtering, DNS Security, and WildFire
• Perform firewall sizing, performance tuning, session analysis, and capacity planning for high-throughput environments
• Use Strata Cloud Manager (SCM) for centralized management, templates, device groups, policy management, and operational workflows
• Lead cutovers during maintenance windows, minimizing customer impact and ensuring rapid rollback capability if required
• Follow strong change management processes appropriate to large enterprise or service provider environments
• Mentor customer engineers on Palo Alto operational best practices following migration
• Communicate complex technical concepts clearly to both engineering and leadership audiences

Your Experience (Qualifications)

• Experience performing a Juniper SRX to Palo Alto NGFW migration is strongly preferred
• Expertise with Palo Alto Networks NGFW architecture, deployment, and operations in large-scale environments (service provider experience is a plus)
• Knowledge of Juniper architecture and the ability to translate Juniper configurations into Palo Alto best practices
• Advanced understanding of Security Policies, NAT Policies, Application-ID, User-ID, Content-ID, and Zone-Based Security
• Strong knowledge of dynamic routing protocols including BGP, OSPF, IS-IS, static routing, route redistribution, and ECMP
• Experience integrating Palo Alto firewalls into complex service provider routing environments with MPLS, EVPN/VXLAN, and large-scale IP transit architectures
• Experience deploying Palo Alto NGFWs in active/passive and active/active high availability architectures
• Experience implementing advanced threat prevention capabilities including IPS, Anti-Malware, URL Filtering, DNS Security, and WildFire
• Ability to perform firewall sizing, performance tuning, session analysis, and capacity planning for high-throughput environments
• Experience with SCM (Strata Cloud Manager) for centralized management, templates, device groups, policy management, and operational workflows

Key Competencies (Preferred / Other Qualifications)

• Ability to lead cutovers during maintenance windows while minimizing customer impact and ensuring rapid rollback if required
• Strong understanding of change management processes within large enterprise or service provider environments
• Ability to mentor customer engineers on Palo Alto operational best practices following migration
• Excellent communication skills, with the ability to translate complex technical concepts for both engineering and leadership audiences
• Familiarity with cloud integrations (AWS, Azure, GCP) and hybrid network security architectures is a plus
• Comfortable working in a hybrid onsite/remote schedule with a customer-embedded team

Education

No specific degree requirement is mandated. Relevant industry certifications (e.g., Palo Alto Networks PCNSE, JNCIA/JNCIS, or equivalent NGFW/routing certifications) are a plus and may be considered alongside equivalent hands-on professional experience.