Palo Alto Security Engineer - Firewall

Location: United Kingdom – Remote/Hybrid, as agreed Employment Type: Contract Programme: Technology Separation / Corporate Divestiture Start: ASAP Position Overview Brave Futures is seeking an experienced, hands-on Palo Alto Security Engineer to support a large-scale technology-separation and corporate-divestiture programme. The engineer will design, deploy, configure, migrate and separate perimeter-security infrastructure using Palo Alto NGFW and Panorama. The role requires strong enterprise firewall engineering, policy migration, routing integration, high availability and security-automation experience. Key Responsibilities

• Design, build and deploy Palo Alto NGFWs across new PoP and perimeter locations
• Configure interfaces, zones, routing, security policies and NAT
• Manage Panorama, Device Groups, Templates and Template Stacks
• Configure Application-ID, User-ID, Content-ID and security profiles
• Implement URL Filtering, Threat Prevention, WildFire and SSL/TLS Decryption
• Analyse, rationalise and optimise complex firewall rulebases
• Separate and migrate firewall policies, objects and connectivity between corporate entities
• Configure and troubleshoot BGP, OSPF, static routing and Policy-Based Forwarding
• Support IPSec, IKEv2, GRE, internet-edge, DMZ and partner connectivity
• Integrate Palo Alto firewalls with PoP, data-centre and hybrid-cloud environments
• Coordinate Zscaler GRE/IPSec tunnel integration and traffic flows
• Deploy and test Active/Passive or Active/Active high-availability configurations
• Automate firewall changes using Terraform, Ansible, Python and Panorama APIs
• Execute configuration changes through Git/GitHub and CI/CD workflows
• Prepare LLDs, migration plans, cutover procedures and rollback documentation Required Skills and Experience
• Strong hands-on Palo Alto NGFW and Panorama experience
• Experience with PA-3200, PA-5200, PA-400 and/or VM-Series
• Device Groups, Templates and Template Stacks
• Firewall-policy design, optimisation and large-rulebase management
• NAT, Application-ID, User-ID and Content-ID
• Threat Prevention, URL Filtering, WildFire and SSL Decryption
• Firewall migration, consolidation or policy-separation experience
• BGP, OSPF, static routing and Policy-Based Forwarding
• IPSec, IKEv2, GRE, internet-edge and DMZ architectures
• Firewall high availability and failover testing
• Terraform, preferably using the PAN-OS Provider
• Python, Ansible, Git/GitHub and CI/CD automation
• AWS, Azure or GCP security and hybrid-cloud connectivity
• Strong documentation, change-management and troubleshooting skills Preferred Experience
• Palo Alto PCNSE certification
• Technology separation, divestiture, M&A or complex firewall migration
• Palo Alto Expedition or comparable migration tools
• Zscaler GRE/IPSec integration
• Panorama APIs and firewall-as-code
• SIEM and log-forwarding integration
• DDoS mitigation and scrubbing-centre experience
• CCNP Security, CISSP or equivalent certification Work Authorisation Candidates must currently be based in the UK and legally authorised to work without requiring current or future employer sponsorship.