Sr Palo Alto Integration Engineer

This position may be filled prior to the posted deadline. Interested candidates are encouraged to apply as soon as Operations Services LLC (KOS) a Koniag Government Services company is seeking an experiencedPalo Alto Integration Engineer (Senior)to support enterprise network security operations and IT administrative and operational support services for a federal government client. This position requires an active security clearance or the ability to obtain and maintain a government background investigation and all requisite IT access authorizations prior to performing work. Specific clearance requirements will be confirmed at time of offer. Primary work will be performed at the client site in Washington DC and approved remote/telework include medical dental and vision insurance 401(k) retirement plan paid time off paid parental leave life and disability insurance flexible spending accounts commuter benefits and tuition role serves as a critical senior technical function responsible for the architecture engineering implementation administration and continuous improvement of enterprise Palo Alto Networks security platform capabilities across a complex geographically distributed federal IT environment spanning on-premises infrastructure cloud platforms and hybrid network ideal candidate is a highly experienced and technically authoritative network security engineer with deep hands-on expertise across the full Palo Alto Networks portfolioincluding Next-Generation Firewalls (NGFW) Panorama Prisma Access Prisma Cloud Cortex XDR and related platformscombined with a comprehensive understanding of enterprise network security architecture Zero Trust principles and Federal cybersecurity compliance requirements. This individual must possess the technical depth architectural vision and operational discipline required to lead the design implementation and sustained operation of enterprise-grade Palo Alto Networks security capabilities that protect Government networks systems and data in a highly regulated federal IT Palo Alto Integration Engineer (Senior) will serve as the programs primary subject matter expert and technical authority for all Palo Alto Networks platform capabilities leading the architecture engineering implementation administration and continuous improvement of enterprise Palo Alto Networks security infrastructure. This individual works closely with network engineers security engineers cloud operations teams DevSecOps engineers cybersecurity leadership and Government stakeholders to ensure Palo Alto Networks platforms are architected deployed and operated in a manner that delivers maximum security value operational resilience and compliance with Federal cybersecurity frameworks and Zero Trust Architecture objectives across the full enterprise responsibilities will include but are not limited to:Architecture & Engineering LeadershipServe as the programs technical authority and subject matter expert for all Palo Alto Networks platform capabilities providing authoritative architectural guidance engineering leadership and expert technical recommendations to program leadership functional teams and Government the design and architecture of enterprise Palo Alto Networks security solutions including NGFW deployments Panorama management infrastructure Prisma Access SASE implementations Prisma Cloud security posture management and Cortex XDR endpoint and network detection and maintain enterprise Palo Alto Networks architecture documentation including network security architecture diagrams data flow diagrams firewall zone models security policy frameworks and platform configuration baselines ensuring documentation is current accurate and aligned with operational security architecture reviews for new systems applications infrastructure changes and cloud migrations assessing Palo Alto Networks platform impact identifying security risks and recommending policy and configuration changes to maintain security and implement Zero Trust network security architectures leveraging Palo Alto Networks capabilities including App-ID based application control User-ID based identity-aware policy enforcement micro-segmentation encrypted traffic inspection and continuous threat emerging Palo Alto Networks technologies platform capabilities and industry security trends providing well-researched recommendations to program leadership and Government stakeholders on opportunities to enhance security posture and operational senior technical leadership and mentorship to junior and mid-level network security engineers sharing expertise guiding technical development and ensuring consistent application of security engineering best practices across the -Generation Firewall Engineering & AdministrationLead the engineering implementation and administration of enterprise Palo Alto Networks Next-Generation Firewall (NGFW) infrastructure across all deployment contexts including perimeter internal segmentation data center and cloud-attached firewall implement and maintain comprehensive NGFW security policy frameworks including application-based policies using App-ID user-based policies using User-ID content inspection policies using Content-ID and threat prevention policies ensuring policies are well-structured consistently applied and aligned with least-privilege access control and maintain advanced NGFW security profiles including antivirus anti-spyware vulnerability protection URL filtering file blocking WildFire malware analysis and DNS security profiles ensuring profiles are tuned to maximize threat prevention effectiveness while minimizing operational and implement SSL/TLS decryption policies ensuring encrypted traffic is inspected in accordance with security requirements while managing certificate trust performance impact and privacy NGFW security policy lifecycle including policy review and optimization cycles rule base cleanup shadow rule identification and policy documentation maintenance ensuring the rule base remains clean efficient and security-effective over regular NGFW security policy audits and optimization reviews identifying overly permissive rules unused policies and policy gaps and implementing improvements to strengthen network segmentation and least-privilege access and maintain NGFW operational runbooks troubleshooting guides and standard operating procedures ensuring the team has the documentation needed to operate and maintain NGFW infrastructure reliably and Management Platform EngineeringLead the engineering implementation and administration of the Panorama centralized management platform ensuring Panorama is properly configured maintained and leveraged to provide consistent scalable and auditable management of all deployed NGFW and related platform and maintain Panorama device group and template hierarchies ensuring management configurations are logically organized consistently applied and aligned with enterprise security policy requirements and operational management and maintain Panorama-based policy management frameworks including shared policy structures pre-rules post-rules and device group-specific policy configurations ensuring policy management is efficient consistent and and maintain Panorama role-based administration controls ensuring administrative access privileges are properly configured and aligned with least-privilege principles and applicable Federal security Panorama platform upgrades patches and configuration changes coordinating with the change management process and ensuring all changes are properly tested documented and approved prior to production Panorama logging and reporting capabilities to develop operational dashboards security reports and compliance evidence artifacts that support program leadership and Government stakeholder visibility Access & SASE EngineeringLead the engineering implementation and administration of Palo Alto Networks Prisma Access Secure Access Service Edge (SASE) capabilities ensuring secure reliable and high-performance remote access and cloud-delivered security services for distributed users and and implement Prisma Access GlobalProtect configurations including gateway deployments agent configurations split tunneling policies and authentication integrations ensuring remote users receive consistent security policy enforcement regardless of and maintain Prisma Access security policy threat prevention URL filtering and data loss prevention capabilities ensuring cloud-delivered security services provide comprehensive protection aligned with enterprise security the integration of Prisma Access with enterprise identity platforms including Microsoft Entra ID and Okta ensuring identity-aware security policy enforcement and multi-factor authentication are consistently applied for all remote access Prisma Access service health performance and security effectiveness proactively identifying and resolving connectivity issues performance degradation and security policy gaps that may impact remote user experience or security Cloud Security EngineeringLead the engineering implementation and administration of Palo Alto Networks Prisma Cloud cloud security posture management (CSPM) and cloud workload protection (CWPP) capabilities across enterprise cloud environments including AWS and Microsoft Azure and maintain Prisma Cloud compliance frameworks security policies and alert configurations ensuring continuous visibility into cloud security posture configuration compliance and threat activity across all monitored cloud accounts and and maintain Prisma Cloud custom compliance policies and security alerts aligned with applicable Federal security frameworks including NIST SP 800-53 FedRAMP CIS Benchmarks and client-specific cloud security Prisma Cloud findings with the enterprise SIEM platform and vulnerability management program ensuring cloud security posture data is incorporated into the programs broader security monitoring and remediation cloud security posture remediation activities working with cloud operations teams to prioritize and remediate Prisma Cloud findings in accordance with defined risk-based remediation XDR Engineering & AdministrationLead the engineering implementation and administration of Palo Alto Networks Cortex XDR extended detection and response capabilities ensuring the platform provides comprehensive endpoint network and cloud telemetry integration and high-fidelity threat detection across the enterprise and maintain Cortex XDR prevention policies behavioral threat protection rules and detection analytics ensuring endpoint protection and detection capabilities are optimized for the enterprise and maintain Cortex XDR detection rules behavioral analytics configurations and BIOC (Behavioral Indicators of Compromise) content aligned with the MITRE ATT&CK framework to ensure comprehensive coverage of relevant adversary Cortex XDR with the enterprise SIEM platform threat intelligence feeds and SOAR capabilities ensuring XDR telemetry and alerts are effectively incorporated into the programs broader security monitoring detection and response Cortex XDR alert triage investigation support and threat hunting activities leveraging XDR telemetry to support incident response efforts and proactively identify undetected threats within the enterprise Cortex XDR platform health agent coverage and detection output quality proactively identifying and resolving platform issues coverage gaps and detection fidelity Prevention & Security EffectivenessLead the continuous improvement of threat prevention effectiveness across all Palo Alto Networks platforms including regular review and optimization of threat prevention profiles WildFire submission policies DNS security configurations and URL filtering and maintain WildFire integration configurations ensuring unknown files and URLs are automatically submitted for analysis and that WildFire verdicts are effectively operationalized within NGFW and Cortex XDR security and analyze threat prevention logs WildFire analysis results and threat intelligence feeds to identify emerging threat patterns new attack techniques and opportunities to improve prevention purple team and detection validation activities coordinating with threat emulation efforts to validate Palo Alto Networks prevention and detection effectiveness and identify gaps requiring configuration improvements or policy and maintain threat prevention effectiveness metrics and reporting providing program leadership and Government stakeholders with accurate visibility into prevention coverage blocked threats and security effectiveness Management & OperationsLead the preparation and submission of Palo Alto Networks change requests for Change Advisory Board (CAB) review developing comprehensive implementation plans technical impact assessments rollback procedures and test plans for all significant platform with the change management process to ensure all Palo Alto Networks platform changes are properly reviewed approved scheduled and implemented without degradation to security posture or service post-implementation reviews for significant Palo Alto Networks platform changes documenting outcomes unexpected impacts and lessons learned to continuously improve the change execution and maintain Palo Alto Networks operational runbooks standard operating procedures and knowledge base articles ensuring the team has comprehensive current documentation to support reliable and consistent platform incident response activities involving Palo Alto Networks platforms providing expert platform knowledge and configuration capabilities to containment eradication and recovery ATO & Continuous MonitoringEnsure all Palo Alto Networks platforms are configured and maintained in compliance with applicable Federal cybersecurity frameworks and requirements including NIST SP 800-53 FISMA FedRAMP NIST SP 800-207 Zero Trust Architecture OMB M-22-09 applicable DISA STIGs and client-specific cybersecurity ATO activities for Palo Alto Networks platforms including security control implementation documentation system security plan (SSP) contribution continuous monitoring reporting and audit evidence regular Palo Alto Networks platform configuration compliance assessments identifying and remediating configuration deviations from applicable security baselines and DISA vulnerability management activities for Palo Alto Networks platforms including tracking prioritizing and remediating platform vulnerabilities identified through vendor advisories vulnerability scanning and continuous monitoring and maintain Palo Alto Networks compliance documentation including configuration baseline specifications security control implementation evidence and audit artifacts supporting the programs ATO and continuous monitoring and Experience:Required:Bachelors degree in Computer Science Information Technology Cybersecurity Network Engineering or a related field from an accredited college or university. Equivalent combination of education and directly relevant experience may be of 7 years of hands-on experience in network security engineering firewall administration or a closely related discipline with at least 5 years of demonstrated hands-on experience engineering and administering Palo Alto Networks platforms in an enterprise hands-on experience designing implementing and administering Palo Alto Networks NGFW infrastructure including security policy development threat prevention profile configuration SSL decryption and Panorama with Palo Alto Networks Prisma Access SASE platform engineering and supporting network security operations in a federal government IT contracting environment including familiarity with applicable Federal cybersecurity compliance security clearance or the ability to obtain and maintain a government background investigation and all requisite IT access authorizations. Specific clearance requirements will be confirmed at time of :Prior experience serving as a senior Palo Alto Networks engineer or architect on a federal IT program of comparable scale and -on experience with Palo Alto Networks Prisma Cloud and Cortex XDR platform engineering and supporting FedRAMP authorization activities and implementing cloud security controls leveraging Palo Alto Networks platforms within AWS GovCloud and/or Microsoft Azure Government Skills and Competencies:Deep technical expertise across the Palo Alto Networks platform portfolio with demonstrated hands-on proficiency in NGFW policy engineering Panorama administration Prisma Access SASE configuration and advanced threat prevention network security architecture skills with demonstrated ability to design implement and maintain enterprise-grade network security architectures incorporating Zero Trust principles micro-segmentation identity-aware policy enforcement and encrypted traffic proficiency with Palo Alto Networks NGFW security policy development including App-ID application control User-ID identity-aware policies Content-ID threat prevention and SSL/TLS decryption policy design and experience with Panorama centralized management platform engineering including device group and template hierarchy design shared policy management and role-based administration knowledge of enterprise networking concepts including routing protocols (BGP OSPF EIGRP) switching VLANs SD-WAN VPN technologies (IPsec SSL) and network segmentation architectures as they relate to Palo Alto Networks security platform with Palo Alto Networks Prisma Access SASE platform engineering including GlobalProtect configuration cloud-delivered security policy and identity platform of Federal cybersecurity frameworks and compliance requirements including NIST SP 800-53 FISMA FedRAMP NIST SP 800-207 Zero Trust Architecture OMB M-22-09 applicable DISA STIGs and CIS understanding of Zero Trust Architecture principles and demonstrated experience implementing Zero Trust network security controls leveraging Palo Alto Networks platform supporting ATO activities including NIST SP 800-53 security control documentation system security plan contribution POA&M management and continuous monitoring program with network traffic analysis and troubleshooting tools including Wireshark packet capture analysis and Palo Alto Networks native diagnostic and logging written and verbal communication skills with demonstrated ability to develop comprehensive security architecture documentation operational runbooks and change management artifacts and to present complex technical security information clearly to both technical and non-technical leadership and mentorship skills with demonstrated ability to provide technical guidance share expertise and develop the capabilities of junior and mid-level team Skills and Competencies:Palo Alto Networks Certified Network Security Engineer (PCNSE) certification strongly Alto Networks Certified Security Automation Engineer (PCSAE) or Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA) Alto Networks Certified Cloud Security Engineer (PCCSE) or equivalent Prisma Cloud Information Systems Security Professional (CISSP) GIAC Certified Enterprise Defender (GCED) or equivalent senior cybersecurity Certified Network Professional Security (CCNP Security) or equivalent enterprise network security certification demonstrating broad network security knowledge complementary to Palo Alto Networks with Palo Alto Networks Cortex XSOAR security orchestration and automation platform engineering and playbook with Palo Alto Networks Cortex XDR extended detection and response platform engineeringOur Equal Employment Opportunity Policy:The company is an equal opportunity employer. The company shall not discriminate against any employee or applicant because of race color religion creed ethnicity sex sexual orientation gender or gender identity (except where gender is a bona fide occupational qualification) national origin or ancestry age disability citizenship military/veteran status marital status genetic information or any other characteristic protected by applicable federal state or local law. We are committed to equal employment opportunity in all decisions related to employment promotion wages benefits and all other privileges terms and conditions of company is dedicated to seeking all qualified applicants. If you require an accommodation to navigate or to apply to a position on our website please contact Heaven Wood via e-mail at or by calling to request accommodations. Koniag Government Services (KGS) is an Alaska Native Owned corporation supporting the values and traditions of our native communities through an agile employee and corporate culture that delivers Enterprise Solutions Professional Services and Operational Management to Federal Government Agencies. As a wholly owned subsidiary of Koniag we apply our proven commercial solutions to a deep knowledge of Defense and Civilian missions to provide forward leaning technical professional and operational solutions. KGS enables successful mission outcomes for our customers through solution-oriented business partnerships and a commitment to exceptional service delivery. We ensure long-term success with a continuous improvement approach while balancing the collective interests of our customers employees and native communities. For more information please visit Opportunity Employer/Veterans/Disabled. Shareholder Preference in accordance with Public Law 88-352