Palo Alto Networks Security Engineer

Cornerstone Concilium is hiring an expert Palo Alto Networks Security Engineer for a two-year, full-time consulting engagement at San Francisco International (SFO). This onsite role centers on modernizing the airport’s security posture as part of a Next-Generation Network program, including migration planning, monitoring setup, and hands-on enablement for airport staff.

In this position, you will lead the security workstream for a new Palo Alto Networks Next-Generation Firewall architecture, support cutovers when needed, and provide documentation and knowledge transfer so the airport team can operate the environment confidently.

Location: San Francisco, CA (onsite)
Compensation: $140,000 to $185,000 USD yearly
Experience: 3+ years

What you’ll do

• Assess current and planned Palo Alto Networks architecture, NGFW configurations, and the Next-Generation Internet Edge design.
• Review Panorama and firewall baselines, including interfaces, zones, routing, and high-availability (HA) design.
• Evaluate security policies, security profiles, and Advanced Threat Prevention (ATP) settings.
• Document findings with gap and risk analysis, and provide remediation recommendations.
• Develop migration strategies, implementation plans, and test plans, including configuration cleanup and rule and policy migration to the new environment.
• Configure firewalls, Panorama, security zones, segmentation, and HA, then validate failover behavior.
• Execute functional, failover, performance, and connectivity testing; support cutovers, including after-hours work when needed.
• Track risks, issues, and dependencies; assist with change management and submit weekly status reports.
• Apply Palo Alto Networks best practices across policies, profiles, and threat prevention.
• Set up dashboards, alerts, and weekly and monthly reports using native tools such as Panorama, Strata Cloud Manager, and Strata Logging Service, including historical trending and performance analysis.
• Troubleshoot issues and open or escalate tickets with Palo Alto Networks.
• Deliver as-built documentation and standard operating procedures (SOPs).
• Lead knowledge-transfer sessions for airport staff.

What you bring

• 10+ years of expert-level Palo Alto Networks experience in large enterprises (campuses with 5+ locations and 20,000+ users). Coverage must include design, assessment, setup, migration, and ongoing support of NGFWs and Panorama, including HA deployments, firewalls with 10G+ throughput, and multi-zone environments with 1,000+ policies.
• Hands-on experience with PA-7500, PA-5450, or PA-3000 series firewalls (or equivalent platforms).
• 10+ years of enterprise cybersecurity assessments, including firewall architecture and configuration review, policy review, threat-prevention checks, and gap, vulnerability, and risk analysis.
• Large firewall migrations of at least 5 HA pairs (10 firewalls) in a single program, including config cleanup, policy translation, failover testing, end-to-end validation, and production cutovers, plus status reporting and change management support.
• 10+ years applying Palo Alto Networks best practices with monitoring, alerts, dashboards, reporting, and trend analysis using native Palo Alto Networks tools such as Panorama and its logging tools (not third-party tools).
• 10+ years writing technical documentation (as-builts, SOPs, troubleshooting guides) and training network and operations teams.
• 3+ years with advanced Palo Alto Networks services, including Advanced Threat Prevention, Prisma Access, Prisma Cloud, and related management and reporting tools.
• Ability to pass an airport security background check and badging process.

Tools and platforms

• Palo Alto Networks Next-Generation Firewall (NGFW)
• Panorama
• Advanced Threat Prevention (ATP)
• Strata Cloud Manager
• Strata Logging Service
• Prisma Access
• Prisma Cloud
• Prisma SD-WAN

Preferred qualifications

• Palo Alto Networks certifications, such as PCNSE.
• Experience with Prisma SD-WAN, Prisma Access, and SASE deployments.
• Experience with Strata Cloud Manager and Strata Logging Service.
• Experience in airports, transportation, critical infrastructure, or the public sector.
• Strong written and spoken communication.

About the program

The airport is modernizing its network as part of a Next-Generation Network program. The program includes a 400 Gbps backbone and a new Palo Alto Networks NGFW architecture that segments airline, concession, enterprise, and critical operations networks. You will lead the security side of assessment, migration, monitoring, and staff training, working closely with network, security, and project management teams.