Firewall and VPN Security Engineer (Palo Alto, Third Line) for NATO with security clearance

Every deployed mission network has an edge and somebody has to be sure of it. This role is that person: third-line engineering on the boundary protection layer next-generation firewalls the rulesets that run on them and the tunnels that carry traffic between sites.

It is a job for someone who is genuinely at home in a firewall policy: not only pushing the change but arguing about whether the rule should exist what it opens and how it will be audited a year from now.

What you would be doing

• Build configure and maintain next-generation firewalls across the mission estate including high-availability pairs and central management.
• Design implement and review security policies and rulesets and adapt them as the operational picture changes.
• Configure and troubleshoot VPN and secure interconnection between sites.
• Take third-line incidents through to root cause working with the network and platform teams rather than throwing tickets over a wall.
• Automate the repetitive parts signature updates configuration backups health checks.
• Keep procedures and security documentation current and report monthly on service performance.

What you would bring

• At least three years in firewall administration and network security.
• Palo Alto certification (PCNSE or equivalent) and real depth in configuration management and troubleshooting.
• Security or an equivalent security qualification.
• Sound networking fundamentals protocols routing architecture and VPN technologies.
• Scripting and automation and the habit of using them.
• Professional English spoken and written to a standard that carries a technical briefing.

The work is on site in Mons in normal office hours with occasional planned night work for change windows and roughly one trip a month to other European locations. CISSP or CCNA is welcome but not expected.