{"id":128691,"url":"https://alion.io/job/paramount-senior-network-security-engineer","title":"Senior Network Security Engineer","company":{"id":48613,"name":"Paramount Computer Systems","domain":"paramountassure.com","url":"https://alion.io/company/paramountassure","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Keka","truth_index":{"grade":"A","score":92,"open_postings":69,"ghost_share":0.043,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":225,"computed_at":"2026-10-16T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":[],"countries":[],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"BGP","optional":false},{"name":"OSPF","optional":false},{"name":"SIEM","optional":false},{"name":"TCP/IP","optional":false},{"name":"Tcpdump","optional":false},{"name":"VLAN","optional":false},{"name":"VPN","optional":false},{"name":"MPLS","optional":true}],"status":"live","first_seen_at":"2026-08-13T05:55:11Z","employer_posted_date":"2026-08-13","last_verified_at":"2026-10-17T00:53:33Z","board_verified":true,"closed_at":null,"days_open":64,"trust":{"level":"ok","repost_count":1,"flags":["company_stale"],"days_open":63},"description":"Position TitleSenior Network Security Engineer / Consultant - Check Point FirewallFunctionNetwork Security Delivery / Professional ServicesReports ToProject Manager / Practice Lead - Network SecurityLocationWork location : Dubai, UAE - Travel to other region as project required. Engagement TypeFull TimeExperience Required8+ years in network security, with a minimum of 5 years hands-on Check Point deliveryPositions Open21. Role Overview\nWe are seeking an accomplished Check Point firewall specialist to join the delivery team for a large-scale, multi-vendor security transformation programme. The engagement involves migrating an existing mixed firewall estatecomprising Juniper, Huawei and Cisco platforms onto a new Check Point Quantum Force high-end appliance estate across different locations, deployed as high-availability clusters and managed through a Multi-Domain Smart-1 architecture.\nThe successful candidate will take a lead technical role across the full delivery lifecycle: source estate discovery and policy audit, target architecture and low-level design, policy conversion and rationalization, staging and commissioning, migration cutover under strict change control, and post-implementation support. This is a hands-on senior position requiring both design authority and the operational discipline to execute cutovers on a live carrier network where the tolerance for service impact is effectively zero.\n2. Key Responsibilities\nDesign & Architecture\nProduce high-level and low-level designs for Check Point gateway clusters, covering ClusterXL high-availability design, interface and bonding architecture, VLAN and addressing plans, and routing integration with the carrier core.\nDesign the multi-domain management and logging architecture, including domain structure, global policy layers, administrator models, log retention and event correlation.\nDefine the target security policy architecture ordered and inline policy layers, object standards, NAT design and VPN topologies and establish the standards that operational teams will work to thereafter.\nDesign Threat Prevention and sandboxing profiles, including IPS, Anti-Virus and Anti-Bot baselines and a staged detect-to-prevent rollout strategy appropriate to high-throughput carrier traffic.\nDevelop migration architecture: parallel installation approach, traffic-swing methodology, soak criteria and technically credible rollback design.\nImplementation & Migration\nLead policy conversion from Juniper, Huawei and Cisco source platforms using Check Point SmartMove and scripted or manual conversion methodologies, followed by manual review, rule rationalization and object normalization.\nBuild and commission high-end Check Point appliances: OS installation and hardening, cluster formation, interface and bonding configuration, SIC establishment and onboarding to the correct management domain.\nConfigure and validate high-speed interfaces in line cards, including optics validation and link aggregation at scale.\nBuild the Smart-1 management and logging infrastructure, including Multi-Domain Server deployment, SmartEvent configuration and SIEM log forwarding.\nAuthor detailed cutover method statements and execute migrations within approved change windows, including on-site presence, live traffic verification and rollback execution where triggers are met.\nTesting, Support & Handover\nDevelop and execute acceptance test plans covering high-availability failover, routing convergence, policy parity against the legacy estate, throughput validation and Threat Prevention behaviour.\nProvide post-migration hypercare support: incident diagnosis, policy and Threat Prevention tuning, performance optimisation and vendor TAC escalation management.\nPerform advanced troubleshooting using packet-level and kernel-level diagnostics, cluster state analysis and acceleration path investigation.\nProduce as-built documentation and operational runbooks, and deliver structured knowledge transfer to customer network operations and security operations teams.\nProgramme & Stakeholder Engagement\nRepresent the delivery organisation in customer design reviews, technical workshops, change advisory boards and acceptance sign-off sessions.\nWork within a phased, wave-based rollout model, meeting entry and exit gate criteria per wave and maintaining delivery quality across parallel site activity.\nMentor junior engineers and contribute to the internal Check Point practice through reusable design patterns, conversion tooling and lessons learned.\n3. Essential Skills & Experience\n Minimum 5 years of hands-on experience designing, implementing and supporting Check Point security gateways, including at least two enterprise or carrier-scale deployments or migrations.\nDeep expertise across the Check Point portfolio: Gaia OS, SmartConsole, Security Management and Multi-Domain Management (MDS/MLM), ClusterXL, Management API, SecureXL and CoreXL acceleration.\nDemonstrable experience with high-end Check Point appliances and high-throughput deploymentsmulti-hundred-gigabit or terabit-class environments, high-density line cards and performance tuning under sustained load.\nProven policy migration experience from third-party firewall vendors like Cisco, Juniper or ScreenOS, Huawei, Fortinet including practical use of SmartMove and post-conversion validation.\nStrong command of Threat Prevention blades and sandboxing: IPS, Anti-Virus, Anti-Bot, Threat Emulation and Threat Extraction, including profile design and false-positive management.\nSolid networking foundation: TCP/IP, routing protocols (OSPF, BGP), VLANs and trunking, link aggregation, NAT, IPSec VPN and high-availability design principles.\nAdvanced troubleshooting capability using fw monitor, tcpdump, kernel debug, cpview, cphaprob and related diagnostic tooling.\nExperience executing changes on production networks under formal change management, including method statement authorship, risk assessment and rollback planning.\nStrong documentation and communication skills, with the ability to present and defend technical designs to senior customer stakeholders.\n4. Certification Requirements\nA valid, current certification is mandatory for this role. Candidates without an active certification at the required level will not be considered.\nMandatory\nCheck Point Certified Security Expert (CCSE) must be valid and current on a supported software release.\nHighly Desirable\nCheck Point Certified Security Master (CCSM) or CCSM Elite.\nCheck Point Certified Multi-Domain Security Management Specialist.\nCheck Point Certified Troubleshooting Expert (CCTE) or Automation Specialist (CCAS).\nComplementary networking or security certification: CCNP/CCIE Security, JNCIP/JNCIE-SEC, HCIP/HCIE-Security\n5. Preferred - Telecommunications Domain Experience\nCandidates with service provider or telecommunications experience will be given clear preference. The following are considered significant advantages:\nPrior delivery experience with a telecom operator, mobile network operator or internet service provider, particularly in a mobile packet core, MPBN or carrier backbone environment.\nUnderstanding of telecom network architecture and the security demarcation between the transport layer and the security layer - including Gi/SGi firewall, roaming and peering security concepts.\nFamiliarity with modern carrier transport technologies: EVPN, Segment Routing (SR-MPLS) and SRv6, and how firewall clusters attach to and interoperate with such fabrics.\nExperience operating within carrier-grade service level commitments, restricted maintenance windows and formal telecom change governance.\nExposure to carrier-scale traffic profiles and the performance engineering considerations that accompany them, including asymmetric routing and high session-rate environments.\nExperience with regulatory, lawful intercept or telecom-specific compliance requirements as they affect security infrastructure design.\n6. Personal Attributes\nComposure and sound judgement when executing high-risk changes on live production networks during constrained maintenance windows.\nMethodical and evidence-driven approach to diagnosis, with the discipline to document decisions and follow agreed process.\nAbility to work independently on customer sites while maintaining alignment with programme governance and reporting.\nWillingness to travel to customer locations as required and to work extended or night-time maintenance windows during cutover phases.\nCollaborative approach with customer teams, with the credibility to advise and, where necessary, respectfully challenge on technical risk.","description_format":"text","description_chars":8591,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United Arab Emirates","iso":"AE","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Network Security","Information Security","Security Compliance","Managed Security"],"lifecycle":[{"event":"open","at":"2026-08-13T05:55:11Z"},{"event":"close","at":"2026-10-06T14:04:58Z"},{"event":"reopen","at":"2026-10-11T19:42:23Z"}],"visa":[],"liveness":{"score":72,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":0.8,"age_days":63,"expected_fill_days":225,"reasons":["conf:2","velocity","win:early","crowd:"],"computed_at":"2026-10-16T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/paramount-senior-network-security-engineer","json_url":"https://alion.io/job/paramount-senior-network-security-engineer.json","meta":{"generated_at":"2026-10-17T05:09:10Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6778,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":48613},"rest":"https://alion.io/mcp/rest/get_company?id=48613"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fparamount-senior-network-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fparamount-senior-network-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fparamount-senior-network-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/paramount-senior-network-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fparamount-senior-network-security-engineer"}]}