About the role

We are seeking a Network Security Engineer to support and execute a migration from Symantec Blue Coat ProxySG to Zscaler Internet Access (ZIA). The role combines hands-on Palo Alto firewall engineering with migration delivery, change management, and troubleshooting across a complex security environment.

Key responsibilities

• Plan and execute the Blue Coat to Zscaler migration, including policy analysis, translation, and phased user and site cutovers

• Review existing Blue Coat policies (URL categories, SSL interception, authentication, bypass rules) and rebuild them in ZIA

• Configure and maintain Palo Alto firewalls (policy, NAT, routing, GlobalProtect, Panorama) to support traffic steering to Zscaler (GRE/IPsec tunnels, PAC files, Zscaler Client Connector)

• Troubleshoot connectivity, SSL inspection, authentication, and performance issues across Palo Alto, Zscaler, and the legacy proxy

• Raise, plan, and implement changes through ServiceNow, including risk assessments, implementation and backout plans, and CAB participation

• Manage incidents, problems, and requests in ServiceNow and keep records accurate

• Produce runbooks, migration documentation, and as-built diagrams

• Coordinate with application owners, network, endpoint, and identity teams, and provide status updates to project leadership

About you

• 5+ years in network security engineering

• Strong hands-on experience with Palo Alto Networks firewalls (PAN-OS, Panorama)

• Proven change management experience in an ITIL-aligned environment, including authoring and implementing changes in ServiceNow

• Strong troubleshooting skills: packet captures, log analysis, traffic flow tracing, and root cause analysis

• Solid understanding of TCP/IP, routing, DNS, proxy concepts, PKI, and SSL/TLS inspection

• Strong written and verbal communication skills

• Preferred: Experience with Zscaler ZIA/ZPA, or with proxy migrations (Blue Coat, Forcepoint, McAfee Web Gateway)

• Preferred: Familiarity with SASE/SSE architecture and zero trust principles

• Preferred: Experience with SAML/SSO and Azure AD/Entra ID integration

• Preferred: Scripting or automation experience (Python, APIs, Terraform)