GlobalProtect SME Engineer

MatchPoint Solutions is a fast-growing young energetic global IT-Engineering services company with clients across the US. We provide technology solutions to various clients like Uber Robinhood Netflix Airbnb Google Sephora and more! More recently we have expanded to working internationally in Canada China Ireland UK Brazil and India. Through our culture of innovation we inspire build and deliver business results from idea to outcome. We keep our clients on the cutting edge of the latest technologies and provide solutions by using industry-specific best practices and expertise.

We are excited to be continuously expanding our team. If you are interested in this position please send over your updated resume. We look forward to hearing from you!

Pay rate $65 to 70/hr

GlobalProtect SME Engineer

Location: Remote

6 months (expected)

This role is at the center of a high-stakes VPN migration initiative - replacing an existing enterprise VPN client with Palo Alto GlobalProtect across thousands of remote macOS endpoints. The right candidate brings deep hands-on GlobalProtect expertise and has navigated this kind of migration before.

Position Overview

• The Senior Palo Alto GlobalProtect SME Engineer will serve as the primary technical authority for the GlobalProtect deployment and migration across enterprise macOS devices. This engagement demands someone who has done this before - who knows the quirks the edge cases and the failure modes of GlobalProtect at scale - and who can execute with precision in a complex remote-user environment.
• A key differentiator for this role is vendor engagement. The ideal candidate maintains active relationships with Palo Alto Networks and is comfortable escalating directly to Palo Alto engineering when issues arise. The ability to throw a problem over the fence to the vendor - and get answers fast - is as important as the technical depth itself.

Key Responsibilities

• Serve as the primary GlobalProtect technical authority for the enterprise macOS VPN migration initiative
• Lead planning engineering and execution of the Palo Alto GlobalProtect deployment across a large remote macOS fleet
• Design and implement silent automated migration workflows that transition users from the existing VPN client to GlobalProtect with minimal disruption
• Engineer phased rollout strategies with built-in rollback capability state validation and fail-safe logic for remote endpoints
• Configure GlobalProtect gateway and portal settings including always-on VPN pre-logon tunnels split tunneling DNS handling and SSL inspection
• Deliver GlobalProtect VPN profiles via Jamf Pro using plist-based configuration and MDM profile deployment
• Manage client certificate delivery SCEP workflows and certificate-based authentication dependencies within the migration sequence
• Develop and maintain Bash/Zsh scripts for VPN state validation certificate presence checks connectivity verification and deployment sequencing
• Build and leverage Jamf Pro Smart Groups and Extension Attributes to track migration state and deployment health in real time
• Escalate rapidly and effectively to Palo Alto Networks engineering when product-level issues are identified
• Troubleshoot complex GlobalProtect connectivity authentication tunnel and client issues across diverse remote user environments

Required Qualifications

• Deep hands-on expertise with Palo Alto GlobalProtect - gateway/portal configuration PAN-OS tunnel architecture and macOS client behavior
• Proven experience leading or executing GlobalProtect deployments and/or migrations in large enterprise environments (10000 devices preferred)
• Direct experience with Palo Alto Networks - prior employment certified partner or active SE/support relationship strongly preferred
• Demonstrated ability to escalate to and collaborate with Palo Alto Networks vendor engineering to resolve platform-level issues
• Experience deploying GlobalProtect silently via MDM (Jamf Pro or Intune) using plist-based configuration profiles on macOS
• Proficiency in Bash/Zsh scripting for deployment automation state validation VPN connectivity checks and error handling
• Strong understanding of certificate-based authentication SCEP PKI and VPN auth dependency sequencing
• Experience configuring always-on VPN pre-logon tunnels split tunneling DNS handling and SSL inspection in GlobalProtect environments
• Working knowledge of Jamf Pro - policies configuration profiles Smart Groups Extension Attributes and script deployment
• Familiarity with macOS security model PPPC profiles system extensions and endpoint compliance controls

MatchPoint Solutions provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race color religion age sex national origin disability status genetics protected veteran status sexual orientation gender identity or expression or any other characteristic protected by federal state or local laws.

This policy applies to all terms and conditions of employment including recruiting hiring placement promotion termination layoff recall transfer leaves of absence compensation and training.