Network Security Architect - Palo Alto Prisma SD-WAN (ION), AWS, PCNSA / PCNSE

Role:   Network Security Architect - Palo Alto Prisma SD-WAN (ION), AWS

Remote - Canada

Required Skills

Networking & SD-WAN

* Must know Palo Alto Prisma SD-WAN (ION) - on prime and AWS Strata Cloud Manager (SCM)

* Prisma Access

* BGP

* OSPF

* Static Routing

* ECMP

* IPSec VPN

* GRE Tunnels

* SD-WAN High Availability (HA)

* MPLS

* DIA

* Broadband Connectivity

* Traffic Engineering and Application-Aware Routing

### Cloud

* AWS VPC

* Transit Gateway

* Direct Connect

* Route Tables

* Security Groups

* NACLs

* AWS Networking Design

* Hybrid Cloud Connectivity

### Security

* Palo Alto NGFW

* Zero Trust Architecture

* SASE/SSE

* Segmentation and Security Policies

* Identity and Access Management

## Roles & Responsibilities

* Design end-to-end Palo Alto Prisma SD-WAN architecture for AWS, branch locations, data centers, and cloud environments.

* Develop HLD and LLD documentation for SD-WAN deployments.

* Design AWS-hosted ION Virtual Appliance architecture including HA clusters and multi-region resiliency.

* Define routing strategies using BGP, static routes, route redistribution, and cloud connectivity models.

* Deploy and onboard Prisma SD-WAN ION Virtual Appliances in AWS.

* Integrate AWS VPCs, Transit Gateway, and Direct Connect with Prisma SD-WAN fabric.

* Configure cloud-to-branch and branch-to-cloud connectivity.

* Design secure connectivity for applications hosted in AWS.

### SD-WAN Implementation

* Configure ION devices, sites, WAN circuits, and VPN fabrics.

* Implement application-aware policies, QoS, and path selection.

* Configure WAN overlays and service links.

* Execute greenfield and brownfield migrations.

* Design active/active and active/standby ION HA clusters.

* Plan failover, redundancy, and disaster recovery scenarios.

* Validate AWS availability zone resilience and WAN failover mechanisms.

### Integrate Prisma Access and Palo Alto SD-WAN & NGFW

* Implement segmentation, secure zones, and security policies.

* Ensure compliance with enterprise security standards.

* Lead migration from traditional WAN or third-party SD-WAN solutions to Prisma SD-WAN.

* Execute cloud migration and data center exit initiatives.

* Perform pilot deployments and production cutovers.

* Diagnose routing, tunnel, and application performance issues.

* Work with Palo Alto TAC for critical incidents and platform bugs.

* Optimize application experience and network performance.

* Provide L3/L4 engineering support.

* Prepare HLD, LLD, MOP, migration runbooks, rollback plans, and SOPs.

* Participate in architecture reviews and customer workshops.

* Present technical solutions to customers and stakeholders.

## Mandatory Certifications

* Palo Alto PCNSA / PCNSE

* Palo Alto Prisma SD-WAN Certification (Preferred)