L2 Operations Engineer – Network Security

Designation: L2 Operations Engineer – Network Security

Support level: L2 Operations

Domain: Network Security

Scope: Palo Alto Firewalls, Zscaler, SSE, ZTNA, Enterprise Browser, Internet Security (SWG and FWaaS), and Private Access

Job Location / Reporting Location: NCR - Gurugram

Process:

• End-to-end incident management, from L1/L1.5 escalation to closure.

• Run firewall health checks (CPU and memory) and act on breaches.

• Collect logs and evidence for firewall alert events.

• Troubleshoot reported issues and check network connectivity.

• Enable new access per application needs, through the client's change process.

• Handle port and rule requests from other teams, including server teams.

• Apply firewall patches and OS upgrades under change control.

• Handle outage calls to restore connectivity.

• Support Zscaler and Palo Alto firewalls.

• Protect data in transit and at rest from unauthorised access.

• Report security issues promptly with recommended actions.

• Follow client security standards and guidelines.

• Keep ServiceNow tickets current, with clear resolution and closure notes.

• Join RCA reviews. Update SOPs and knowledge-base articles.

• Work with Connectivity, Hosting, IDAM, DLP and Malware Tools on cross-tower issues.

• Trace policy evaluation in SSE (Zscaler Internet Access, Prisma Access and similar) – URL filtering, Cloud Firewall, SSL inspection, DLP, CASB – and in Prisma Access (security, decryption, URL filtering rules) to find unexpected allows or blocks.

• Diagnose Private Access failures across application segments, segment groups, server groups, access policies and Private Service Edge.

• Troubleshoot forwarding profiles, PAC files, trusted network detection and bypass configuration.

• Diagnose GRE and IPsec tunnel failures to Zscaler, and Remote Network and Service Connection tunnels in Prisma Access, including IKE/IPsec phase issues.

• Resolve DNS issues for private apps, including split DNS, conditional forwarding and DNS search domains.

• Troubleshoot SAML assertion and attribute problems, SCIM provisioning failures and group sync issues with Entra ID, Okta or Ping.

• Resolve device posture and trusted network check failures.

• Take and analyse packet captures (Wireshark, tcpdump, connector-side captures).

• Correlate logs across the SSE platform, SIEM, IdP and endpoint tools.

• Use ZDX and ADEM data to diagnose latency, edge selection and path problems.

Tools:

• Palo Alto firewalls (Cloud Firewalls)

• Zscaler

• Palo Alto NGFW, Panorama, Strata Cloud Manager, Strata Logging Service, Prisma Access

• Splunk SIEM

• Datadog

• Enterprise monitoring tools

• ServiceNow

• Okta (secondary skill)

Technologies:

• Subject-matter expertise (8+ years) in NGFWs, WAFs, multi-cloud networking and security controls, core networking protocols, and security architecture – primarily Palo Alto, AWS and Azure, with GCP and Alibaba Cloud as a plus.

• Deploying security policies with IPS, URL filtering, DNS security and SSL inspection.

• Firewall security policy tuning with tools such as AlgoSec.

• Quickly identifying and remediating root cause.

• ITaaS, ITIL, monitoring and metrics.

• Multi-cloud networking.

• Firewall administration.

• Secure web gateway.

• Access and rule management.

• Network segmentation.

• Firewall log analysis.

• TCP/IP and routing basics.

• Python or Ansible scripting.

• IaC tooling: GitHub, Octopus, Terraform.

• DNS expertise.

Experience:

• 12 years of experience in L2 network security operations

• 24x7 support environment

• Palo Alto firewall administration

• Zscaler administration (scope to be confirmed)

• Enterprise networking expertise

• Firewall rule and port request handling

• Log and evidence collection

• ITSM incident, problem and change processes

• Clear written and spoken English

Certifications:

• Palo Alto PCNSA / PCNSE

• Zscaler administrator certification

• CCNA

• A Proxy / SSE industry certification (Zscaler or Palo Alto)

Interested person can drop their resume at [email protected] with following details:

Current CTC:

Expected CTC:

Notice period: