{"id":297800,"url":"https://alion.io/job/ahead-principal-technical-consultant-network-security","title":"Principal Technical Consultant - Network Security","company":{"id":3614,"name":"AHEAD","domain":"ahead.com","url":"https://alion.io/company/ahead","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":74,"open_postings":53,"ghost_share":0,"stale_share":0.849,"repost_share":0,"time_to_fill_p50_days":68,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Solutions","role_family":"Solutions","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":210000,"max":240000,"currency":"USD","period":"year","gross":null,"usd_annual":240000},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Ansible","optional":false},{"name":"AWS","optional":false},{"name":"AWS WAF","optional":false},{"name":"Azure","optional":false},{"name":"BGP","optional":false},{"name":"CI/CD","optional":false},{"name":"DLP","optional":false},{"name":"DNS","optional":false},{"name":"FortiGate","optional":false},{"name":"GCP","optional":false},{"name":"HIPAA","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"Nginx","optional":false},{"name":"NIST 800-53","optional":false},{"name":"Okta","optional":false},{"name":"OSPF","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PCI DSS","optional":false},{"name":"Prisma","optional":false},{"name":"Rest API","optional":false},{"name":"SIEM","optional":false},{"name":"Snort","optional":false},{"name":"Splunk","optional":false},{"name":"Terraform","optional":false},{"name":"VLAN","optional":false},{"name":"VMWare","optional":false},{"name":"VPN","optional":false},{"name":"Zero Trust","optional":false},{"name":"Zscaler","optional":false},{"name":"Akamai","optional":true},{"name":"Assembly","optional":true},{"name":"CloudFormation","optional":true},{"name":"JavaScript","optional":true},{"name":"Node JS","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-08-17T23:02:57Z","employer_posted_date":"2026-08-17","last_verified_at":"2026-10-17T15:51:48Z","board_verified":true,"closed_at":null,"days_open":60,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":60},"description":"We are seeking a Principal Technical Consultant to serve as the senior technical leader for network security engagements across four core pillars: next-generation firewall design and deployment (Palo Alto Networks, Cisco Secure Firewall, Fortinet), Cisco ISE-based network access control and identity services, load balancing and application delivery (F5 BIG-IP, including web application firewall and global server load balancing), and SASE and Zero Trust architectures (Zscaler, Palo Alto Prisma Access). Principal Technical Consultants design, deploy, and troubleshoot highly complex environments spanning multiple networking and security domains. They lead large, multi-technology projects, guide cross-functional delivery teams, and act as trusted advisors to client technical staff and executive leadership. This role owns end-to-end delivery from discovery and architecture through implementation, testing, cutover, and knowledge transfer, while also mentoring engineers across the organization, supporting sales campaigns as a subject matter expert, and building the reusable assets and industry content that advance the practice.\nKey Responsibilities - Firewall:\nDesign and deploy Palo Alto Networks next-generation firewalls running PAN-OS, including App-ID, User-ID, and Content-ID enforcement, security profiles (Antivirus, Anti-Spyware, Vulnerability Protection, WildFire), SSL/TLS decryption, and centralized management through Panorama or Strata Cloud Manager.\nDesign and deploy Fortinet FortiGate firewalls running FortiOS, including security profiles and inspection modes, virtual domains (VDOMs), centralized policy management through FortiManager, and logging and reporting through FortiAnalyzer.\nDesign and deploy Cisco Secure Firewall Threat Defense (FTD) managed by on-premises Firewall Management Center or cloud-delivered Firewall Management Center through Cisco Security Cloud Control, including Snort 3 intrusion policies, malware defense, URL filtering, and high-availability pairs.\nLead firewall migration programs including legacy Cisco ASA to FTD conversions and cross-vendor migrations to Palo Alto, Fortinet, or Cisco platforms, owning policy translation, rule base optimization, phased cutover, and rollback planning.\nDesign network segmentation architectures using firewall zones, virtual routers, VDOMs, VRFs, and policy-based routing to enforce least-privilege north-south and east-west traffic controls.\nImplement firewall high availability designs including active/standby failover, active/active clustering, multi-context and multi-VDOM deployments, and state synchronization for large enterprise and service provider environments.\nDeploy cloud-native and virtual firewall solutions including Palo Alto Cloud NGFW for AWS and Azure, FortiGate virtual appliances across AWS, Azure, and GCP, and Cisco Secure Firewall Threat Defense Virtual for hybrid and cloud workload environments.\nDesign and deploy site-to-site IPsec VPN and remote access VPN architectures using GlobalProtect, FortiClient, and Cisco Secure Client, including route-based and policy-based tunnel selection and redundant termination.\nConfigure centralized logging, SIEM integration (Splunk, Microsoft Sentinel, syslog), and NetFlow/IPFIX export for traffic analytics, threat correlation, and compliance reporting.\nPerform firewall rule base optimization, policy cleanup, and compliance auditing to reduce attack surface and align with regulatory frameworks including PCI-DSS, HIPAA, and NIST 800-53.\nAutomate firewall provisioning, configuration backup, and policy deployment using infrastructure-as-code tooling (Terraform, Ansible) and vendor APIs including the PAN-OS REST and XML APIs, the FortiOS REST API, and the Firewall Management Center REST API.\nKey Responsibilities - Network Access Control:\nDeploy Cisco Identity Services Engine (ISE) for 802.1X wired and wireless authentication, MAC Authentication Bypass (MAB), and RADIUS and TACACS+ device administration across campus, branch, and data center environments.\nDesign and implement ISE authorization policies including Security Group Tags (SGTs) with TrustSec, downloadable ACLs (dACLs), dynamic VLAN assignment, and Adaptive Network Control for automated threat response.\nConfigure ISE profiling services, posture assessment, and compliance enforcement to establish endpoint visibility and confirm that devices meet organizational security baselines before access is granted.\nIntegrate ISE with Cisco network infrastructure (Catalyst switches, wireless LAN controllers, Secure Firewall) and third-party network access devices for consistent policy enforcement across heterogeneous environments.\nDeploy ISE guest portals, BYOD onboarding workflows, and certificate-based authentication (EAP-TLS) integrated with internal or external certificate authorities for secure device enrollment.\nImplement pxGrid integrations to share identity and session context between ISE, Cisco Secure Firewall, SIEM platforms, and third-party security tooling for unified policy enforcement.\nDesign ISE distributed deployments spanning Policy Administration Nodes, Policy Service Nodes, and Monitoring and Troubleshooting Nodes to meet scale, redundancy, and geographic distribution requirements.\nExtend identity-based segmentation beyond the access layer by propagating SGTs into firewall and fabric policy through SGACLs and SXP, aligning NAC policy with the broader segmentation architecture.\nLead ISE upgrades and migrations, including legacy ACS to ISE transitions and major version upgrades, and perform advanced troubleshooting using RADIUS live logs, policy trace, packet capture, and debug utilities.\nDeliver HPE Aruba ClearPass engagements where a client has standardized on ClearPass for network access control, including policy design, device profiling, and onboarding workflows.\nKey Responsibilities - Load Balancing & Application Delivery:\nDesign and deploy F5 BIG-IP Local Traffic Manager, including virtual servers, pools, health monitors, persistence profiles, SSL offload and re-encryption, local traffic policies, and iRules for advanced traffic steering and content switching.\nImplement global server load balancing with F5 BIG-IP DNS, including wide IPs, GSLB pools, topology records, static and dynamic load balancing methods, iQuery synchronization with LTM devices in each data center, and DNS TTL strategies tuned to required failover times.\nDeploy and tune F5 BIG-IP Advanced WAF, including OWASP Top 10 protection, attack signature selection and tuning, positive and negative security models, Policy Builder learning workflows, behavioral DoS, bot defense, credential stuffing protection, and DataGuard response masking.\nImplement API security controls including OpenAPI specification import and schema enforcement, JSON and XML payload validation, and discovery of undocumented endpoints surfaced through policy learning.\nDesign BIG-IP high availability using Device Service Clustering, sync-failover device groups, traffic groups, and network failover for active/standby and active/active deployments across data centers and cloud regions.\nDeploy F5 BIG-IP Access Policy Manager for application access and identity federation, and F5 BIG-IP SSL Orchestrator for policy-based SSL/TLS decryption with dynamic service chaining to next-generation firewalls, intrusion prevention, DLP, and sandbox inspection services.\nDeliver NGINX Plus and NGINX App Protect deployments, including Kubernetes ingress controller integration, WAF policy delivered through APPolicy custom resource definitions, and container-native application protection for microservices architectures.\nImplement F5 Distributed Cloud services including Web Application and API Protection, bot defense, multi-cloud application connectivity, and DNS-based global load balancing delivered as a managed service.\nArchitect cloud-native load balancing and application protection using AWS Application and Network Load Balancers with AWS WAF, and Azure Application Gateway and Front Door with Azure WAF, including hybrid patterns that span on-premises BIG-IP and cloud-native services.\nAutomate application delivery configuration using the F5 Automation Toolchain (AS3, Declarative Onboarding, and Telemetry Streaming), iControl REST, and the F5 Terraform provider, integrating declarative application services into client CI/CD pipelines.\nLead application delivery controller refresh, consolidation, and migration programs, including application discovery, dependency mapping, virtual server translation, and phased cutover with validated rollback.\nKey Responsibilities - SASE & Zero Trust:\nDesign and implement SASE and Zero Trust architectures covering remote user, branch office, cloud workload, and data center connectivity use cases under a unified security policy framework.\nConfigure and deploy Zscaler Internet Access including Secure Web Gateway, SSL inspection, URL filtering, cloud firewall, sandboxing, and inline DLP, and Zscaler Private Access including ZTNA application segments, App Connectors, and browser-based access.\nDeploy Palo Alto Prisma Access including GlobalProtect remote user connectivity, explicit proxy for branch offices, and service connections to on-premises infrastructure, managed through Strata Cloud Manager or Panorama, and extend coverage to unmanaged devices with Prisma Access Browser.\nDesign traffic forwarding and steering architectures including GRE tunnels, IPsec tunnels, PAC files, and client connectors, with failover behavior and bandwidth planning validated against client site topology.\nImplement identity-based access controls integrating with Okta, Microsoft Entra ID, SAML 2.0, and SCIM provisioning, combined with device posture and trust signals, to enforce conditional access consistently across every SASE platform in scope.\nDesign SASE and SD-WAN convergence strategies across Fortinet Secure SD-WAN, Palo Alto Prisma SD-WAN, and Cisco Catalyst SD-WAN, maintaining policy consistency across direct internet access and backhauled traffic paths.\nDeploy Cloud Access Security Broker and Data Loss Prevention controls in both inline and API-based modes to protect sanctioned and unsanctioned application usage.\nDesign east-west segmentation to complement SASE north-south controls, using firewall zones and VRFs, ISE TrustSec Security Group Tags, and data center fabric segmentation through Cisco ACI contracts or VMware NSX distributed firewall policy.\nDevelop and maintain Zero Trust maturity roadmaps for clients, mapping current-state gaps to phased adoption plans across the identity, device, network, application, and data pillars.\nArchitecture, Delivery & Documentation:\nLead client-facing discovery sessions, design workshops, and architecture reviews to define firewall, network access control, application delivery, and SASE strategies aligned to business objectives and compliance requirements.\nOwn the creation of High-Level Design and Low-Level Design documents, network diagrams, policy matrices, implementation runbooks, and as-built documentation across all technology domains in the engagement.\nDevelop migration and cutover plans with rollback procedures, change management workflows, and change advisory board review packages.\nOwn delivery of large, multi-technology engagements end to end, sequencing workstreams, tracking milestones and deliverables, and escalating risk proactively to project and account leadership.\nServe as the design authority and technical escalation point for Senior Technical Consultants, Technical Consultants, and offshore engineers, reviewing configurations and design decisions before they reach the client.\nContribute to engagement scoping through level-of-effort estimation, scope guardrails, and documented assumptions that produce accurate and profitable statements of work.\nConduct knowledge transfer sessions and train client operations teams on day-2 firewall management, ISE policy administration, application delivery operations, SASE platform adminis...","description_format":"text","description_chars":18716,"description_truncated":true,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Network Security","IT Consulting & Digital Transformation","Managed IT Services (MSP)","AI Consulting & Integration"],"lifecycle":[{"event":"open","at":"2026-09-05T14:52:18Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 23 · green card filings: 4","filings_12m":23,"filings_prev_12m":21,"green_card_filings_12m":4,"median_offered_wage_usd":151759,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":3}],"liveness":{"score":33,"band":"fade","label":"Fading","p_open":1,"p_active":0.55,"p_room":0.6,"age_days":60,"expected_fill_days":68,"reasons":["conf:3","stale_co","velocity","win:late","crowd:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":{"stated_usd_annual":240000,"is_top_pay":true},"html_url":"https://alion.io/job/ahead-principal-technical-consultant-network-security","json_url":"https://alion.io/job/ahead-principal-technical-consultant-network-security.json","meta":{"generated_at":"2026-10-17T16:04:49Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":21921,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3614},"rest":"https://alion.io/mcp/rest/get_company?id=3614"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fahead-principal-technical-consultant-network-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fahead-principal-technical-consultant-network-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fahead-principal-technical-consultant-network-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ahead-principal-technical-consultant-network-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fahead-principal-technical-consultant-network-security"}]}