{"id":1519630,"url":"https://alion.io/job/ppl-first-sr-network-security-engineer","title":"Sr Network Security Engineer","company":{"id":1932483,"name":"PPL First","domain":"pplfirst.com","url":"https://alion.io/company/pplfirst","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":117000,"max_usd":212000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":220},"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Ansible","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"Claude","optional":false},{"name":"Copilot","optional":false},{"name":"DNS","optional":false},{"name":"FortiGate","optional":false},{"name":"HIPAA","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"NIST 800-53","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"Terraform","optional":false},{"name":"VPN","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-06-11T00:00:00Z","employer_posted_date":"2026-06-11","last_verified_at":"2026-10-01T12:57:09Z","board_verified":true,"closed_at":null,"days_open":113,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":112},"description":"It's fun to work in a company where people truly BELIEVE in what they're doing!\nWe're committed to bringing passion and customer focus to the business.\nPublic Partnerships LLC (PPL) provides helps people with disabilities, chronic illnesses, or other long-term health conditions stay at home and “self-direct” their care. Known as consumer direction in New York, this long-term care model empowers people to take control of who provides their services and where. PPL was selected to be the Statewide Fiscal Intermediary for the New York Consumer Directed Personal Assistance Program (CDPAP) starting in 2025. We will, along with a diverse alliance of service partners across the state, support the delivery of culturally sensitive and disability competent care to CDPAP participants. We are looking for people who share our passion for helping New Yorkers live happy, healthy, and independent lives to support CDPAP consumers and their personal assistants across a broad spectrum of services and functions.\nOur culture attracts and rewards people who are compassionate, results-oriented, and driven to exceed customer expectations. We desire motivated candidates who are excited to join our fast-paced, consumer-focused environment, and who want to make a difference in helping transform the lives of the people we serve.\nLearn more about PPL and CDPAP at https://pplfirst.com/cdpap\nJob Summary\nThe Senior Network Security Engineer is a hands-on technical security leader responsible for ensuring that PPL's network environment - including its cloud-primary infrastructure in Microsoft Azure, secondary presence in AWS, Fortinet-protected physical locations, and remote-first workforce - is designed, configured, and operated in alignment with PPL's security requirements, standards, and regulatory obligations. Reporting to the Director of Cybersecurity Operations, this role defines network security requirements, reviews and validates network architecture and controls, performs security assessments and audits, and partners closely with the Infrastructure team's Sr. Network Engineer, who owns administration of PPL's network and network security devices. The role serves as the Information Security team's subject matter expert on network security - driving zero-trust strategy, supporting incident response, evidencing compliance, and protecting the confidentiality and integrity of Medicare and Medicaid protected health information (PHI).\nKey Responsibilities\nNetwork Security Strategy, Standards & Architecture Review\nDefine and maintain PPL's network security requirements, standards, and baselines for cloud, on-premises, and remote-access environments - including Fortinet firewall configuration baselines, Azure and AWS network security baselines, segmentation standards, and secure remote-access requirements.\nReview and validate network architecture and design changes from a security perspective - providing requirements, recommendations, and sign-off as appropriate before changes are implemented by Infrastructure or Cloud Engineering.\nDrive PPL's zero-trust networking strategy across cloud, physical, and remote-workforce environments - establishing the security model, segmentation principles, and identity-aware access requirements that Infrastructure and Cloud Engineering execute against.\nEvaluate, recommend, and provide security requirements for new network security technologies (SASE/SSE platforms, NDR, DNS security, etc.) that improve visibility, reduce risk, and support automation across the enterprise.\nDefine network-layer and zero-trust controls for enterprise AI service traffic - including egress policies, conditional access, and data-leakage protections for approved AI assistants (e.g., Microsoft Copilot, Claude) to enable responsible AI use while protecting PHI and proprietary data.\nPartner closely with the broader Infrastructure team - including the Sr. Network Engineer, systems and cloud engineers, and supporting infrastructure staff - to translate network security requirements into actionable engineering work and maintain consistent controls across Azure, AWS, Fortinet, and remote-access environments.\nCollaborate with DevOps and Cloud Engineering teams to embed network security controls into infrastructure-as-code, CI/CD pipelines, and automated deployment patterns - ensuring network security is enforced consistently and at the speed of delivery.\nPartner with Application Development teams on secure application network design - reviewing API exposure, service-to-service communication, ingress/egress requirements, and third-party integration patterns to ensure new and existing applications align with PPL's network security standards.\nNetwork Threat Detection & Incident Response\nConduct security reviews and assessments of PPL's network environment - including Fortinet firewall and wireless infrastructure (e.g., FortiGate, FortiAnalyzer), Azure network controls (NSGs, Azure Firewall, Application Gateway/WAF, private endpoints, ExpressRoute/VPN gateways), AWS network controls (security groups, NACLs, AWS Network Firewall, WAF, Transit Gateway, etc.), and ZTNA/VPN platforms.\nLead periodic firewall rule reviews, segmentation validation, access-path analysis, and review of third-party network connections (vendor VPNs, B2B integrations, partner tunnels) and approved AI service connections to identify overly permissive rules, stale exceptions, and gaps against PPL's security standards; partner with Infrastructure on remediation.\nValidate secure configuration of network and network security devices against industry benchmarks (e.g., CIS, Fortinet hardening guides, cloud provider best practices) and PPL's internal standards - through periodic reviews and continuous posture monitoring where available.\nCoordinate with the vulnerability management program to identify, prioritize, and track remediation of network-related vulnerabilities across Fortinet devices, cloud network services, and supporting infrastructure.\nLead architecture-level network security review for new initiatives - including new applications, SaaS solutions, and IT purchases with network connectivity or data-flow implications - ensuring alignment with PPL's network security standards.\nDevelop and report network security posture metrics to leadership - including firewall rule review coverage, segmentation gaps, network vulnerability remediation, and progress against zero-trust initiatives - to inform program prioritization and demonstrate control effectiveness.\nNetwork Threat Detection & Incident Response\nServe as the Information Security team's senior escalation point for network-related security incidents - supporting investigation, containment, eradication, and recovery efforts across cloud and on-premises environments.\nLead network forensics activities, including packet capture analysis, flow analysis (NetFlow, VPC flow logs), and review of firewall, proxy, and DNS logs to reconstruct attacker activity and inform response decisions.\nUtilize the SIEM platform during incident investigation and response - running network-focused queries across firewall, proxy, DNS, and cloud network telemetry to correlate events, identify scope, and reconstruct attacker activity.\nLeverage the enterprise XDR platform to correlate network signal with endpoint, identity, and email data during incidents - enabling cross-domain visibility that informs containment, remediation, and root-cause analysis.\nLead network-specific threat hunting and adversary behavior analysis aligned to MITRE ATT&CK and current threat intelligence - particularly for techniques involving network reconnaissance, lateral movement, and data exfiltration in cloud and remote-access environments - in partnership with the Security Operations, IT & Cloud Security, AppSec/DevSecOps, and GRC functions across the broader incident response program.\nDirect network-layer containment actions (firewall blocks, segmentation changes, DNS sinkholing, conditional access enforcement, etc.) during active incidents - working through Infrastructure for execution and ensuring changes are documented and reversible.\nContribute to post-incident reviews, identifying network-related root causes and recommending architectural, configuration, or operational improvements.\nMonitoring & Detection Oversight\nProvide security oversight of network monitoring tools and platforms - including NDR, IDS/IPS, DNS security, and the use of firewall, proxy, and TLS-inspection logs - ensuring detections, alerts, and logging meet PPL's security requirements.\nCollaborate with SOC analysts on tuning network-layer detections to reduce false positives, improve signal quality, and align with current threat intelligence.\nMaintain situational awareness of emerging network-based threats, vulnerabilities, and attack vectors (e.g., ransomware command-and-control patterns, DNS tunneling, cloud lateral movement) and translate them into updated requirements, detections, and review priorities.\nMaintain documentation for network security standards, review procedures, runbooks, and assessment findings to support operational consistency and audit readiness.\nRisk, Compliance & Governance Support\nProvide network security input into risk assessments, evaluating systems, applications, vendors, and services for network-layer exposure and recommending mitigating or compensating controls.\nPartner with the GRC function to evidence network security controls for NIST 800-53, HIPAA, SOC 2, and CMS audits - including firewall rule review evidence, segmentation documentation, cloud network configuration, and remote-access control artifacts.\nCollaborate with the GRC function on the development, maintenance, and enforcement of network security policies, standards, and procedures across the organization.\nReview and approve WAF and firewall policy changes, AI service access requests, and temporary security exceptions - ensuring requests align with PPL's network security standards and that exceptions are documented, time-bounded, and tracked through to remediation or renewal.\nCollaboration, Communication & Awareness\nPartner across Infrastructure, Cloud Engineering, DevOps, Application Development, and the broader Cybersecurity team to translate security requirements into effective controls without disrupting business operations.\nCommunicate network security findings, risks, and recommendations to both technical and non-technical audiences, including leadership.\nContribute to security awareness initiatives, particularly around safe remote work practices, secure remote access, and phishing/social-engineering threats with a network component.\nProvide technical mentorship and direction to junior security and SOC staff on network security concepts, tooling, and investigation techniques.\nRequired Skills:\nStrong knowledge of information security and network security principles, controls, and best practices across cloud, on-premises, and remote-workforce environments.\nHands-on experience assessing, configuring, or operating Fortinet firewall environments (FortiGate, FortiAnalyzer, FortiManager) at scale; ability to review configurations, rules, and policies for security compliance.\nDemonstrated knowledge of cloud network security in Microsoft Azure (NSGs, Azure Firewall, Application Gateway/WAF, private endpoints, hub-and-spoke design, ExpressRoute/VPN gateways) and AWS (security groups, NACLs, AWS Network Firewall, WAF, Transit Gateway, PrivateLink).\nExperience defining security requirements and reviewing architectures for ZTNA and secure remote access for distributed and remote-first workforces, including conditional access, identity-aware proxies, and integration with modern identity platforms.\nDemonstrated experience with network segmentation, micro-segmentation, and zero-trust networking principles.\nProficiency in network protocols, routing, switching, TLS inspection, and packet/flow analysis sufficient to support detection engineering and incident response across cloud and...","description_format":"text","description_chars":15819,"description_truncated":true,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Network Security","Health Care","Professional Services","Health Insurance & Benefits"],"lifecycle":[{"event":"open","at":"2026-09-30T11:04:12Z"}],"liveness":{"score":14,"band":"cold","label":"Long shot","p_open":1,"p_active":0.497,"p_room":0.28,"age_days":112,"expected_fill_days":40,"reasons":["conf:18","win:tail","crowd:"],"computed_at":"2026-10-01T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/ppl-first-sr-network-security-engineer","json_url":"https://alion.io/job/ppl-first-sr-network-security-engineer.json","meta":{"generated_at":"2026-10-02T01:54:15Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":2466,"day_limit":5000,"remaining_today":2534,"minute_limit":60,"resets_at":"2026-10-03T00:00:00Z"}}}