Network Security Engineer

Job Description

The Network Security Engineer is responsible for designing, implementing, securing, and automating the enterprise network security infrastructure supporting global manufacturing, engineering, office, cloud, and data center environments. This role combines hands-on engineering of Palo Alto firewalls, network segmentation, secure remote access, proxy services, and Zero Trust architectures with the development of automation frameworks, AI-driven operational workflows, and Model Context Protocol (MCP) integrations that improve efficiency and reduce operational risk. The engineer partners with global infrastructure, cloud, and security teams to deliver resilient, scalable, and secure network solutions while driving continuous innovation through automation, Infrastructure as Code, API integrations, and AI-powered network security operations.

Essential Duties & Responsibilities

AI & Intelligent Automation

• Design, develop, and maintain AI-powered automation solutions that improve the efficiency, accuracy, and scalability of network security operations.
• Build AI agents capable of performing network security analysis, policy validation, troubleshooting, incident triage, and operational workflows.
• Develop and maintain Model Context Protocol (MCP) tools and integrations that enable Large Language Models (LLMs) to securely interact with Palo Alto Networks, Panorama, SCM, network infrastructure, CMDBs, monitoring platforms, and security systems.
• Leverage AI to automate firewall policy analysis, change validation, risk assessment, rule optimization, and compliance reporting.
• Evaluate emerging AI technologies and recommend opportunities to improve network security engineering, operational efficiency, and user experience.

Network Security Automation & Platform Engineering

• Design and develop automation using Python, Ansible, Terraform, REST APIs, and Infrastructure-as-Code methodologies.
• Develop reusable automation frameworks for firewall deployments, policy management, VPN provisioning, certificate lifecycle management, and network segmentation.
• Build API integrations between Palo Alto Networks, Panorama, Cisco infrastructure, ServiceNow, SIEM platforms, identity providers, and cloud services.
• Create self-service automation capabilities that reduce manual engineering effort while maintaining enterprise security standards.
• Develop automated configuration validation, compliance auditing, and policy drift detection.

Network Security Architecture & Engineering

• Design, implement, and optimize secure network architectures for engineering, office, and cloud environments.
• Develop security designs for new sites, applications, and infrastructure projects while aligning with Zero Trust principles.
• Create and maintain network security standards, reference architectures, and design documentation.
• Evaluate new network security technologies and recommend improvements to the enterprise security architecture.
• Support SAML, RADIUS, TACACS+, LDAP, and certificate-based authentication.

Zero Trust & Segmentation

• Design and implement micro-segmentation strategies across campus, data center, manufacturing, and cloud environments.
• Develop segmentation policies based on business risk, application dependency mapping, and least-privilege access.
• Partner with application owners to reduce unnecessary network trust relationships

Cloud Network Security

• Engineer secure connectivity between on-premises data centers and cloud environments (Azure, AWS, GCP).
• Design cloud firewall policies, VPN connectivity, and cloud-native security controls.
• Support hybrid network security architecture for multi-cloud deployments.

Security Platform Integration

• Integrate network security infrastructure with:
  • Cisco ISE
  • Active Directory
  • PKI
  • SIEM platforms
  • SOAR solutions
  • Identity Providers
  • Endpoint security platforms

Security Governance

• Perform firewall rule reviews and recertification.
• Identify overly permissive policies and recommend remediation.
• Support compliance initiatives including ISO 27001, NIST, and customer security requirements.
• Participate in security audits and remediation activities.

Global Protect & Remote Access Operations

• Support secure remote access for APAC employees and contractors.
• Troubleshoot authentication, access, and routing issues across hybrid AD environments.

Qualifications

• 5-7 years Strong experience with Palo Alto firewalls, Panorama, and SCM.
• Familiarity with manufacturing or lab network environments preferred.
• Ability to troubleshoot complex routing, segmentation, and PAN Global Protect issus.
• Experience with authentication (RADIUS, AD, SAML) and VPN platforms.
• English proficiency for global collaboration is strongly preferred.

Additional Information

Powered by SmartRecruiters - Candidate Privacy Policy

Compensation: 320400 to 452300 (CNY) (YEARLY)