What success looks like in this role:
Skill Set: Firewall Security Engineer (Basic Troubleshooting, Fortinet and Palo Alto, Any Firewall Experience)
1. Core Firewall Skills
Fortinet FortiGate
Understanding of FortiOS CLI and GUI navigation
Interface, zone, and VDOM configuration (including HA pairs such as FGT-A/B)
Firewall policy creation, review, and troubleshooting (source, destination, service, NAT, security profiles)
Routing: static routes, BGP, OSPF, and policy-based routing
Basic VPN troubleshooting (IPsec site-to-site, SSL VPN)
HA status checks (get system ha status), failover validation, and config sync
Session and traffic troubleshooting: diagnose sniffer packet, diagnose debug flow, get router info bgp, session table review
Log review and threat/event analysis via FortiAnalyzer or FortiGate logs
Firmware upgrade planning and config backup/restore
Palo Alto Networks
PAN-OS navigation (web UI and CLI)
Security policy, NAT policy, and Zone-based configuration
Security profiles (Antivirus, Anti-Spyware, URL Filtering, File Blocking, WildFire)
Routing: static, BGP, and OSPF on virtual routers
VPN: IPsec tunnels and GlobalProtect basics
HA (active/passive, active/active) status and failover checks
Troubleshooting tools: show session all, test security-policy-match, packet-capture, show routing route, debug dataplane, system and traffic logs
Panorama basics for centralized management
Content and PAN-OS upgrade planning
Vendor-Neutral Firewall Concepts
Stateful inspection, NAT (SNAT, DNAT, PAT), and zone-based design
OSI layer troubleshooting approach (ping, traceroute, packet capture, logs)
Routing protocols: BGP fundamentals (peering, AS-path, local preference, route advertisement)
IPsec and TLS basics
Asymmetric routing and how it causes dropped sessions
Change management and rollback practices
2. Cloud and Network Platform Skills
Microsoft Azure networking: VNets, peering, Route Server, ExpressRoute, VPN Gateway, Network Security Groups, and route tables (UDR)
Azure NVA deployment: Understanding of firewall appliances deployed as virtual machines in hub-spoke topologies
Route Server and BGP: Peer status, learned and advertised routes, and route preference
ExpressRoute and Global Reach: Basic understanding of circuit and peering behavior
Azure permissions and tools: Azure Portal, Azure CLI, and Network Watcher (connection troubleshoot, NSG flow logs, IP flow verify)
Routing and switching fundamentals: VLANs, subnetting, ARP, and L2 extension concepts
3. Security Operations Skills
These map to the role’s responsibility to work with senior security engineers on protection, detection, and response.
Security policy hardening and least-privilege rule design
Threat log analysis and incident triage (IPS, malware, malicious URL, and blocked-traffic events)
Basic SIEM familiarity (Splunk, Microsoft Sentinel, or FortiAnalyzer)
Vulnerability and patch awareness for firewall OS and platform software
Incident response support: containment steps, evidence collection, and escalation
Understanding of the cybersecurity lifecycle: identify, protect, detect, respond, recover
4. Operational and Process Skills
Change execution: Following approved change plans, runbooks, and rollback steps for adds, moves, and changes
Documentation: Maintaining operating procedures, configuration records, and network diagrams
Ticketing and workflow: Using ServiceNow, Jira, or similar tools to request, track, and close work
Transitions and migrations: Supporting cutovers, parallel runs, and knowledge transfer
Coordination: Working with GITS, application owners, and senior engineers during maintenance windows
Communication: Clear status updates, escalation of blockers, and stakeholder notifications
5. Metrics and Reporting
Collecting firewall and security metrics on a routine basis (policy hit counts, blocked threats, VPN uptime, HA status, and device health)
Producing weekly or monthly reports for senior security engineers and management
Tracking change…