Opportunity brief
Unisys is hiring for the role of Network Security Engineer!
Responsibilities of the Candidate:
- Understanding of FortiOS CLI and GUI navigation
- Interface, zone, and VDOM configuration (including HA pairs such as FGT-A/B)
- Firewall policy creation, review, and troubleshooting (source, destination, service, NAT, security profiles)
- Routing: static routes, BGP, OSPF, and policy-based routing
- Basic VPN troubleshooting (IPsec site-to-site, SSL VPN)
- HA status checks (get system ha status), failover validation, and config sync
- Session and traffic troubleshooting: diagnose sniffer packet, diagnose debug flow, get router info bgp, session table review
- Log review and threat/event analysis via FortiAnalyzer or FortiGate logs
- Firmware upgrade planning and config backup/restore
- PAN-OS navigation (web UI and CLI)
- Security policy, NAT policy, and Zone-based configuration
- Security profiles (Antivirus, Anti-Spyware, URL Filtering, File Blocking, WildFire)
- Routing: static, BGP, and OSPF on virtual routers
- VPN: IPsec tunnels and GlobalProtect basics
- HA (active/passive, active/active) status and failover checks
- Troubleshooting tools: show session all, test security-policy-match, packet-capture, show routing route, debug dataplane, system and traffic logs
- Panorama basics for centralized management
- Content and PAN-OS upgrade planning
- tateful inspection, NAT (SNAT, DNAT, PAT), and zone-based design
- OSI layer troubleshooting approach (ping, traceroute, packet capture, logs)
- Routing protocols: BGP fundamentals (peering, AS-path, local preference, route advertisement)
- IPsec and TLS basics
- Asymmetric routing and how it causes dropped sessions
- Change management and rollback practices
Requirements:
- Microsoft Azure networking: VNets, peering, Route Server, ExpressRoute, VPN Gateway, Network Security Groups, and route tables (UDR)
- Azure NVA deployment: Understanding of firewall appliances deployed as virtual machines in hub-spoke topologies
- Route Server and BGP: Peer status, learned and advertised routes, and route preference
- ExpressRoute and Global Reach: Basic understanding of circuit and peering behavior
- Azure permissions and tools: Azure Portal, Azure CLI, and Network Watcher (connection troubleshoot, NSG flow logs, IP flow verify)
- Routing and switching fundamentals: VLANs, subnetting, ARP, and L2 extension concepts
- Security policy hardening and least-privilege rule design
- Threat log analysis and incident triage (IPS, malware, malicious URL, and blocked-traffic events)
- Basic SIEM familiarity (Splunk, Microsoft Sentinel, or FortiAnalyzer)
- Vulnerability and patch awareness for firewall OS and platform software
- Incident response support: containment steps, evidence collection, and escalation
- Understanding of the cybersecurity lifecycle: identify, protect, detect, respond, recover
- Change execution: Following approved change plans, runbooks, and rollback steps for adds, moves, and changes
- Documentation: Maintaining operating procedures, configuration records, and network diagrams
- Ticketing and workflow: Using ServiceNow, Jira, or similar tools to request, track, and close work
- Transitions and migrations: Supporting cutovers, parallel runs, and knowledge transfer
- Coordination: Working with GITS, application owners, and senior engineers during maintenance windows
- Collecting firewall and security metrics on a routine basis (policy hit counts, blocked threats, VPN uptime, HA status, and device health)
- Producing weekly or monthly reports for senior security engineers and management
- Tracking change success rate, incident trends, and patch compliance
- Using dashboards in FortiAnalyzer, Palo Alto Panorama or Cortex, Azure Monitor, or similar tools
- Communication: Clear status updates, escalation of blockers, and stakeholder notifications
- BA/BS degree and 0-2 years' relevant experience OR equivalent combination of education and experience