Senior Network Engineer - Firewall Engineering

Requisition Id 17051 Overview: Oak Ridge National Laboratory (ORNL) is currently seeking qualified applicants to serve as a Senior Network Engineer supporting unclassified operations. The successful candidate will possess advanced knowledge of network engineering, firewall architecture, network security policy, enterprise network design, and the interactions among complex information systems.This position will emphasize the engineering, architecture, implementation, and lifecycle management of enterprise firewall services. The candidate will collaborate with teams across the laboratory, including Enterprise Networking, Information Technology, the Classification Office, Cybersecurity, Laboratory Enterprise Risk, Internal Audit, and other organizations as appropriate.The Senior Network Engineer will assist Enterprise Networking in developing secure, reliable, and scalable solutions that support the laboratory’s long-term growth. The engineer will evaluate complex technical and security requirements and develop enterprise-class network and firewall solutions that improve service availability, operational efficiency, and ORNL’s overall cybersecurity posture.The position requires the ability to apply industry standards and government security requirements within ORNL’s environment. The engineer will serve as a technical leader and subject-matter expert for firewall architecture.Major Duties/Responsibilities: Work with multiple divisions within ORNL’s Information Technology Directorate to design, implement, maintain, and improve complex information systems that comply with U.S. Department of Energy (DOE), other applicable government, and local cybersecurity policies.Evaluate how existing information systems integrate with one another and determine how new technologies can be securely incorporated into the enterprise environment.Develop solutions that balance cybersecurity, availability, performance, maintainability, and mission requirements.Design and maintain enterprise firewall architectures supporting campus, data center, internet-edge, remote-access, and segmented network environments.Serve as a subject-matter expert for firewalls, firewall management, VPN clients, and associated security services.Translate business, mission, technical, and cybersecurity requirements into secure firewall designs and implementation plans.Lead firewall deployments, migrations, upgrades, hardware refreshes, policy conversions, and platform-standardization initiatives.Troubleshoot complex connectivity, routing, application, performance, high-availability, and security-policy issues across multiple network and system layers.Monitor firewall capacity, system health, software lifecycle status, security advisories, and emerging threats; recommend upgrades or architectural changes when appropriate.Participate in scheduled maintenance activities and provide escalation or on-call support for critical network-security services as required.Deliver ORNL’s mission by aligning behaviors, priorities, and interactions with our core values of Impact, Integrity, Teamwork, Safety, and Service. Promote equal opportunity by fostering a respectful workplace – in how we treat one another, work together, and measure success.Basic Qualifications:BS degree in computer science, information technology, cybersecurity, engineering, or a related discipline, with 8 years of professional experience. An equivalent combination of education and experience may be considered.Significant experience designing, implementing, and supporting enterprise network and firewall environments.Advanced hands-on experience with Next-Gen firewalls and centralized management.Strong knowledge of TCP/IP, IPv4 and IPv6, subnetting, routing, switching, network segmentation, access control, NAT, VPN technologies, and high-availability design.Knowledge of network-security architecture, defense-in-depth, least privilege, zero trust, and secure network-design principles.Experience working within structured change-control, configuration-management, and incident-management processes.Preferred Qualifications:Ability to prepare clear technical documentation and communicate effectively with technical and nontechnical stakeholders.Ability to work independently, lead complex technical efforts, and collaborate effectively across organizational boundaries.Experience with Palo Alto Networks technologies such as GlobalProtect, Advanced Threat Prevention, Advanced URL Filtering, WildFire, DNS Security, User-ID, App-ID, and SSL/TLS decryption.Experience managing large or distributed Palo Alto firewall environments using Panorama templates, template stacks, device groups, and policy hierarchy.Experience integrating firewalls with identity and authentication technologies such as Active Directory, LDAP, RADIUS, SAML, multifactor authentication, and certificate-based authentication.Experience with network automation and configuration management using Python, PowerShell, Ansible, Terraform, REST APIs, or similar technologies.Familiarity with public- or private-cloud networking and security, including Palo Alto VM-Series or cloud-native firewall integrations.Experience working in a federal government, DOE, national laboratory, research, critical-infrastructure, or similarly regulated environment.Familiarity with applicable security frameworks and guidance, including NIST publications, federal cybersecurity requirements, and security control assessment processes.Relevant certifications such as Palo Alto Networks Certified Network Security Engineer, Palo Alto Networks Certified Network Security Architect, Cisco Certified Network Professional, or comparable credentials.Special Requirements:Visa sponsorship: Visa sponsorship is not available for this position.Security, Credentialing, Eligibility Requirements: Q Clearance: This position requires the ability to obtain and maintain a clearance from the Department of Energy. As such, this position is a Workplace Substance Abuse (WSAP) testing designated position. WSAP positions require passing a pre-placement drug test and participation in an ongoing random drug testing program.Hybrid Eligibility: For Hybrid eligible positions: In addition, we offer a flexible work environment that supports both the organization and the employee. A hybrid/onsite working arrangement may be available with this position.About ORNL:As a U.S. Department of Energy (DOE) Office of Science national laboratory, ORNL has an impressive 80-year legacy of addressing the nation’s most pressing challenges. Our team is made up of over 7,000 dedicated and innovative individuals! Our goal is to create an environment where a variety of perspectives and backgrounds are valued, ensuring ORNL is known as a top choice for employment. These principles are essential for supporting our broader mission to drive scientific breakthroughs and translate them into solutions for energy, environmental, and security challenges facing the nation.ORNL offers competitive pay and benefits programs to attract and retain individuals who demonstrate exceptional work behaviors. The laboratory provides a range of employee benefits, including medical and retirement plans and flexible work hours, to support the well-being of you and your family. Employee amenities such as on-site fitness, banking, and cafeteria facilities are also available for added convenience.Other benefits include the following: Prescription Drug Plan, Dental Plan, Vision Plan, 401(k) Retirement Plan, Contributory Pension Plan, Life Insurance, Disability Benefits, Generous Vacation and Holidays, Parental Leave, Legal Insurance with Identity Theft Protection, Employee Assistance Plan, Flexible Spending Accounts, Health Savings Accounts, Wellness Programs, Educational Assistance, Relocation Assistance, and Employee Discounts.This position will remain open for a minimum of 5 days after which it will close when a qualified candidate is identified and/or hired.We accept Word (.doc, .docx), Adobe (unsecured .pdf), Rich Text Format (.rtf), and HTML (.htm, .html) up to 5MB in size. Resumes from third party vendors will not be accepted; these resumes will be deleted and the candidates submitted will not be considered for employment.If you have trouble applying for a position, please email View email address on click.appcast.io is an equal opportunity employer. All qualified applicants, including individuals with disabilities and protected veterans, are encouraged to apply. UT-Battelle is an E-Verify employer.