Job Description
Applied's IT organization has a long reputation of being a great place to work. The IT team has been recognized as one of Computerworld's 100 Best Places to Work in IT. In addition, numerous Applied IT leaders have been honored as CIO Magazine's Ones to Watch or Computerworld Premier 100 IT leaders.
We are seeking a Senior Network Security Engineer with deep expertise in enterprise firewall architecture and engineering to design, implement, secure, and continuously improve Applied Materials' global network security infrastructure.
This role is hands-on and highly technical, with primary responsibility for Palo Alto Networks NGFW, Panorama, Strata Cloud Manager, firewall policy architecture, security controls, lifecycle management, advanced troubleshooting, and automation across global data centers, manufacturing facilities, campuses, R&D, OT, and cloud environments.
The role partners closely with cybersecurity, cloud, network, OT, application, and infrastructure teams to deliver secure, resilient, scalable, and standardized network security services.
Core Competencies
Expert-level experience in enterprise network security and firewall technologies within large, global environments.
Deep hands-on expertise with Palo Alto Networks NGFW, PAN-OS, Panorama, Strata Cloud Manager, PA-Series and VM-Series.
Experience with Fortinet FortiGate, Forti Manager, and Forti Analyzer is preferred.
Strong experience architecting and governing enterprise firewall rule bases, security policies, NAT, segmentation, policy lifecycle, recertification, and rule optimization.
Deep knowledge of App-ID, User-ID, Device-ID, Security Profiles, SSL/TLS Decryption, Advanced Threat Prevention, IPS, URL Filtering, DNS Security, and WildFire.
Experience with firewall posture and policy-management solutions including Palo Alto AIOps/BPA, SCM, Skybox, and Tufin.
Expertise in high-availability firewall architectures using Active/Passive, Active/Active, HA clustering, ECMP, VSYS/VDOM, and multi-tenancy.
Strong understanding of TCP/IP, Ethernet, BGP, OSPF, EIGRP, IPsec, VLANs, HSRP, QoS, Multicast, ACLs, MPLS, SD-WAN, and VPN technologies.
Advanced troubleshooting and packet-analysis experience using PAN-OS packet diagnostics, session analysis, global counters, flow diagnostics, and Wireshark.
Experience with SSE/SASE, Zero Trust, SWG, CASB, ZTNA, DLP, and Remote Browser Isolation, preferably using Prisma Access and Zscaler ZIA/ZPA.
Experience securing Azure, AWS, and GCP environments using Palo Alto VM-Series, Cloud NGFW, and cloud-native controls.
Experience integrating network security platforms with SIEM/XDR/SOAR solutions including Splunk and Google Chronicle
Ability to independently solve complex Layer 3 through Layer 7 security problems and provide technical leadership to other engineers.
Key Responsibilities
1. Firewall Engineering & Architecture
Design, implement, and support global Palo Alto Networks firewall infrastructure, including PA-Series, VM-Series, Panorama, and Strata Cloud Manager.
Design resilient firewall architectures across data center, campus, manufacturing, OT, R&D, and cloud environments.
Define global firewall reference architectures, configuration standards, security baselines, and deployment patterns.
Engineer HA, routing, NAT, VPN, segmentation, PBF, ECMP, VSYS, virtual routing, and multi-tenancy architectures.
Define Panorama device-group, template, and template-stack architectures.
Support Fortinet firewall infrastructure where required.
2. Firewall Policy & Security Controls
Architect and govern enterprise firewall rule structures, policy hierarchy, objects, naming standards, and lifecycle processes.
Lead firewall rule base optimization and migration from port-based policies to application- and identity-based policies.
Design and implement App-ID, User-ID, Device-ID, Security Profiles, SSL/TLS Decryption, IPS, Advanced Threat Prevention, DNS Security, URL Filtering, and WildFire.
Reduce unused, duplicate, shadowed, overly permissive, and high-risk firewall policies.
Establish firewall policy recertification, ownership, change-control, and compliance processes.
Perform configuration and security posture reviews using SCM, Palo Alto BPA/AIOps, Skybox, Tufin, and CIS benchmarks.
3. Firewall Lifecycle & Operational Excellence
Own PAN-OS and FortiOS lifecycle management, software upgrades, hardware refresh, vulnerability remediation, capacity planning, and performance optimization.
Lead advanced troubleshooting of complex firewall, routing, NAT, VPN, decryption, application, and connectivity issues.
Perform packet captures, session analysis, flow diagnostics, and Root Cause Analysis for major incidents.
Serve as a senior escalation point for critical network security incidents and infrastructure outages.
Develop operational standards, runbooks, health checks, KPIs, and engineering documentation.
4. SSE, SASE & Zero Trust
Design and support SSE/SASE architectures leveraging Prisma Access and Zscaler ZIA/ZPA.
Engineer SWG, CASB, ZTNA, DLP, Remote Browser Isolation, private application access, and cloud-delivered security controls.
Support secure remote access for employees, contractors, and third parties using identity, device posture, and Zero Trust principles.
Integrate security platforms with Microsoft Entra ID, Okta, SAML, SCIM, Cloud Identity Engine, EDR, and device-posture services.
Support modernization and replacement of legacy VPN architectures with ZTNA where appropriate.
5. Cloud Network Security
Architect network security across Azure, AWS, and GCP.
Design and operate Palo Alto VM-Series and Cloud NGFW deployments.
Secure hybrid-cloud traffic using Azure ExpressRoute, AWS Direct Connect, VPNs, Transit Gateway, Virtual WAN, hub-and-spoke architectures, and centralized inspection.
Implement network segmentation and Zero Trust controls across on-premises and cloud environments.
Partner with cloud teams to integrate firewall services with cloud-native routing, security groups, load balancers, DNS, and identity services.
6. Security Monitoring & Incident Response
Integrate firewall telemetry with enterprise SIEM/XDR/SOAR platforms.
Engineer logging and telemetry using Syslog, CEF, APIs, and cloud integrations.
Support security investigations, incident containment, threat analysis, and remediation.
Partner with Security Operations to improve firewall-based detection and response capabilities.
Develop monitoring, dashboards, alerts, and operational security metrics.
7. Technical Leadership & Project Delivery
Lead global initiatives including firewall modernization, segmentation, data center migrations, cloud security transformation, SSE/SASE adoption, and Zero Trust programs.
Develop HLDs, LLDs, implementation plans, test plans, migration plans, rollback plans, and operational runbooks.
Lead complex security projects from architecture through implementation and operational handoff.
Evaluate new technologies, lead proof-of-concepts, and provide platform recommendations.
Mentor engineers and establish technical standards and engineering best practices.
Present architecture, risk, project status, and technology recommendations to IT and cybersecurity leadership.
8. Governance, Risk & Compliance
Ensure firewall and network security controls align with corporate security requirements and frameworks including NIST CSF, ISO 27001, CIS Controls, and applicable export-control requirements.
Lead firewall rule recertification, configuration audits, security assessments, and vulnerability-remediation activities.
Identify and document network security risks and drive remediation with technical and business stakeholders.
Maintain auditable firewall standards, configuration baselines, and security-control documentation.
Functional Knowledge
Demonstrates expert conceptual and practical knowledge of firewall and network security technologies with broad knowledge of networking, cloud, identity, endpoint, and security operations.
Applies industry best practices and emerging technologies to improve enterprise network security services.
Business Expertise
Understands business and technical requirements within a large global enterprise and translates them into scalable, secure, resilient, and cost-effective network security solutions.
Evaluates security, operational, technology, and business risks when making architecture decisions.
Leadership
Provides technical leadership and guidance to engineers and cross-functional teams.
Leads complex global network security projects with significant technical scope and risk.
Influences architecture, engineering standards, security policy, and technology direction.
Problem Solving
Solves highly complex Layer 3 through Layer 7 network security problems.
Uses packet analysis, telemetry, logs, threat intelligence, and multiple sources of technical information to identify root cause and implement sustainable solutions.
Impact
Directly impacts the security, availability, resiliency, and performance of Applied Materials' global network infrastructure and business-critical services.
Establishes standards and architectures that influence network security implementations across global environments.
Interpersonal Skills
Communicates complex technical and security topics clearly to engineers, cybersecurity teams, application owners, business stakeholders, vendors, and leadership.
Builds consensus across global and cross-functional organizations.
Demonstrates strong technical documentation and presentation skills.
Required Qualifications
8+ years of enterprise Network Security Engineering experience.
5+ years hands-on Palo Alto Networks experience in architecture, deployment, engineering, or advanced operations.
Expert knowledge of PAN-OS, Panorama, App-ID, User-ID, NAT, SSL Decryption, Security Profiles, Threat Prevention, VPN, and security-policy management.
Strong experience with enterprise firewall architecture, policy governance, and lifecycle management.
Expert knowledge of TCP/IP, BGP, OSPF, routing, VPN, and network segmentation.
Advanced firewall troubleshooting and packet-analysis capabilities.
Experience designing secure, highly available network architectures.
Experience with enterprise cloud and hybrid-cloud environments.
Experience leading complex infrastructure or security projects.
Strong analytical, documentation, communication, and stakeholder-management skills.
Preferred Qualifications
Experience with Fortinet FortiGate/FortiManager/FortiAnalyzer.
Experience with Strata Cloud Manager, Palo Alto AIOps/BPA, Skybox, or Tufin.
Experience deploying firewalls in Azure, AWS, and/or GCP.
Experience with Prisma Access and/or Zscaler ZIA/ZPA.
Experience with SIEM/XDR/SOAR integrations.
Experience with OT/manufacturing network security and segmentation.
Experience within large-scale, globally distributed enterprise environments.
Education & Experience
Bachelor's Degree in Computer Science, Engineering, Information Technology, Cybersecurity, or related field required.
8–12 years of relevant experience in network and network security engineering.
Certifications
Highly Preferred
Palo Alto Networks PCNSE
CISSP
Preferred / Plus
CCNP Security / CCIE Security
Fortinet certifications
Zscaler certifications
Microsoft Azure networking/security certifications
AWS Advanced Networking / Security certifications
Additional Information
Time Type
Full time
Employee Type
Assignee / Regular
Travel
Yes, 10% of the Time
Relocation Eligible
No
The salary offered to a selected candidate will be based on multiple factors including location, hire grade, job-related knowledge, skills, experience, and with consideration of internal equity of our current team members. In addition to a comprehensive benefits package, candidates may be eligible for other forms of compensation such as participation in a bonus and a stock award program, as applicable.
For all sales roles, the posted salary range is the Target Total Cash (TTC) range for the role, which is the sum of base salary and target bonus amount at 100% goal achievement.
Applied Materials is an Equal Opportunity Employer. Qualified applicants will receive consideration for employment without regard to race, color, national origin, citizenship, ancestry, religion, creed, sex, sexual orientation, gender identity, age, disability, veteran or military status, or any other basis prohibited by law.
In addition, Applied endeavors to make our careers site accessible to all users. If you would like to contact us regarding accessibility of our website or need assistance completing the application process, please contact us via e-mail at Accommodations_Program@amat.com, or by calling our HR Direct Help Line at 877-612-7547, option 1, and following the prompts to speak to an HR Advisor. This contact is for accommodation requests only and cannot be used to inquire about the status of applications.
