Senior Network Engineer – Palo Alto Firewall Migration

Project Overview We need an experienced Palo Alto Networks engineer to take over an in-progress Sophos to Palo Alto migration project. A previous engineer has completed a portion of the work. We need someone to review the current state, pick up where they left off, and drive the project to completion. The engagement covers a full migration from Sophos XG/XGS firewalls to Palo Alto PA-Series firewalls across 6 hospitality client locations (4 HA pairs, 2 standalone units), managed centrally through a net-new Panorama deployment, with GlobalProtect VPN as the remote access solution. Environment • From: Sophos XG 2300 (HA pairs) and XGS 126 (standalone) • To: Palo Alto PA-1410 (HA pairs) and PA-540 / PA-440 (standalone) • Management: Panorama (net-new), zero-touch provisioning • VPN: GlobalProtect with two-site redundancy, SSO via O365 / Entra ID / MFA / federation • SIEM: Integration with existing Thrive SIEM for logging and alerting • Directory: Active Directory / Entra ID integration for user and group based policy Scope of Remaining Work (est. 80 hours) Exact remaining scope will be confirmed after a handoff review of the current state, but is expected to draw from: • Security zone design and VLAN consolidation (Inside, Outside, DMZ) • Security policy migration and cleanup using Palo Alto NGFW best practices • NAT rule migration • GlobalProtect VPN configuration, SSO integration, and HIP profiling • Staging and lab validation • Cutover planning and execution across HA and standalone sites • Testing, optimization, and Thrive SIEM verification • As-built documentation and knowledge transfer What We Need From You • Strong hands-on experience with Palo Alto PAN-OS and Panorama, ideally including greenfield Panorama deployments • Experience migrating from another firewall vendor (Sophos, Fortinet, Cisco, etc.) to Palo Alto • GlobalProtect VPN configuration experience, including SSO/MFA integration • Comfortable stepping into a partially completed project, reviewing existing configuration and documentation, and working from someone else’s starting point • Strong communication skills for coordinating cutover windows with a hospitality client sensitive to peak-season downtime • Ability to work efficiently and independently once ramped up Nice to Have • Experience with Thrive SIEM or similar log forwarding/SIEM integrations • Hospitality industry experience or familiarity with multi-site retail/hospitality network environments • PCNSE certification