Job Summary
HCLTech is looking for an accomplished Firewall Security Compliance Engineer for its Noida location. This is a critical technology role responsible for engineering, operational stability, security, service resilience and continuous improvement across a complex enterprise environment. The role requires deep hands-on expertise, disciplined change execution, strong troubleshooting capability and effective collaboration with infrastructure, application, security, service-management and vendor teams.
Key Responsibilities
- Lead firewall security compliance and audit remediation across Palo Alto, Fortinet and Cisco FTD/FMC platforms.
- Assess and remediate rulebase, NAT, HA, VPN, SD-WAN, access, logging and policy hygiene gaps.
- Perform advanced troubleshooting using packet captures, session/flow analysis and log correlation.
- Manage Panorama, FortiManager/FortiAnalyzer and Cisco FMC, including upgrades, patching, health monitoring and vendor TAC cases.
- Document evidence, RCA, HLD/LLD, SOPs and runbooks while ensuring stable, secure and compliant operations.
Skill Requirements
Experienced Compliance Level 3 (L3) Firewall Engineer to serve as the senior technical authority for the enterprise network security infrastructure. This role owns advanced troubleshooting, design validation, escalation resolution, and lifecycle management across multi-vendor firewall platforms (Palo Alto Networks, Fortinet, and Cisco FTD/FMC) and the connectivity services that run on them, including Remote Access VPN, Client-to-Site, Site-to-Site VPN, and SD-WAN. As the final internal escalation point below vendor TAC, the L3 Engineer resolves complex incidents, drives root cause analysis, mentors L1/L2 staff, and ensures the security estate remains stable, secure, and compliant. Key Responsibilities • Act as the highest-level internal escalation point for firewall and VPN incidents, resolving complex, high-severity issues within SLA. • Perform deep-dive troubleshooting across Palo Alto, Fortinet, and Cisco FTD firewalls, including packet captures, session/flow analysis, and log correlation. • Design, review, and validate firewall rulebases, security policies, NAT, routing, and high-availability configurations. • Own the configuration, optimization, and troubleshooting of VPN and connectivity services: Remote Access VPN (RAVPN), Client-to-Site (C2S), Site-to-Site (S2S), and SD-WAN. • Manage and maintain centralized management platforms — Panorama, FortiManager/FortiAnalyzer, and Cisco FMC — including policy push, object management, upgrades, and health monitoring. • Plan and execute firmware/software upgrades, patching, and hardware refreshes with proper change management. • Conduct root cause analysis (RCA) for recurring and major incidents and drive permanent corrective actions. • Harden firewall configurations against security best practices and support audit, compliance, and vulnerability remediation activities. • Create and maintain HLDs/LLDs, runbooks, SOPs, and knowledge base articles. • Engage and manage vendor TAC cases through to resolution. • Mentor and provide technical guidance to L1 and L2 engineers. • Participate in an on-call rotation for critical escalations. Primary (Must-Have) Skills Firewall Platforms • Palo Alto Networks (PA): Advanced hands-on experience with PA-Series NGFW, App-ID, User-ID, Content-ID, security profiles, zones, and troubleshooting. • Fortinet (FortiGate): Strong expertise in FortiGate NGFW policy design, security profiles, VDOMs, and troubleshooting. • Cisco FTD & FMC: Solid experience administering and troubleshooting Cisco Firepower Threat Defense (FTD) firewalls managed via Firepower Management Center (FMC). Management Platforms • Panorama – centralized management for Palo Alto. • FortiManager / FortiAnalyzer – centralized management, logging, and reporting for Fortinet. • Cisco FMC – centralized management for FTD. Connectivity & VPN Services • RAVPN (Remote Access VPN): GlobalProtect, FortiClient/SSL-VPN, Cisco AnyConnect/Secure Client. • C2S (Client-to-Site): Client-based secure remote connectivity. • S2S (Site-to-Site VPN): IPsec/IKEv1/IKEv2 tunnels, route-based and policy-based VPNs. • SD-WAN: Design, deployment, and troubleshooting on Fortinet, Palo Alto (Prisma SD-WAN), and/or Cisco platforms. Core Networking • Strong TCP/IP, routing (BGP, OSPF, static), NAT, VLANs, and QoS fundamentals. • Proficiency with packet capture and analysis (Wireshark, tcpdump, platform-native captures). • High Availability (Active/Passive, Active/Active) design and troubleshooting. Secondary (Good-to-Have) Skills • Cloud security and firewalling (Azure, AWS, GCP) and Prisma Access / SASE. • Zero Trust Network Access (ZTNA) concepts and deployment. • Automation and scripting (Python, Ansible, REST APIs) for policy and configuration management. • Integration with SIEM, NAC, and MFA/identity solutions. • Experience with ITSM tools (ServiceNow) and structured change/incident/problem management (ITIL). • Basic kn
Other Requirements
DETAILED ROLE ACCOUNTABILITIES
- Lead firewall risk, policy-governance, recertification and audit-remediation activities across Palo Alto, Fortinet and Cisco estates.
- Identify and remediate overly permissive, unused, duplicate, shadowed, expired or non-compliant rules and objects.
- Validate logging, administrator access, backup, HA, software, certificate, VPN and security-profile controls.
- Produce clear evidence, exception records, remediation trackers, RCA and governance reporting for stakeholders.
- Partner with application, network, security and audit teams to deliver risk reduction without disrupting services.
DESIRED CERTIFICATIONS (GOOD TO HAVE)
- Palo Alto PCNSE
- Fortinet NSE 4 or above
- Cisco CCNP Security/CCIE Security
- CCNP
- ITIL Foundation.
PROFICIENCY EXPECTATIONS
Competent (L3): Independently deliver firewall compliance and audit requirements, mitigate firewall/VPN gaps, execute complex changes and validate rulebases, NAT, HA and VPN/SD-WAN configurations.
Proficient (L4): Own enterprise firewall/security-connectivity architecture, governance, standards and compliance frameworks; lead vendor escalations and mentor L3 engineers.
CANDIDATE PROFILE
- Strong hands-on experience in the stated technology domain and enterprise operations environment.
- Ability to independently troubleshoot complex issues, document solutions and collaborate with cross-functional stakeholders.
- Strong communication, change management, incident management and problem-solving skills.
- Willingness to work from the Noida location and support operational requirements as applicable.
REQUIRED EXPERIENCE AND CAPABILITIES
- Bachelor’s degree in Computer Science, Information Technology, Engineering or a related discipline, or equivalent relevant experience.
- Demonstrated hands-on experience supporting business-critical enterprise environments and handling complex incidents and changes.
- Working knowledge of ITIL-aligned incident, problem, change, request and knowledge-management processes.
- Ability to create HLD/LLD, implementation plans, rollback plans, SOPs, runbooks, RCA documents and operational reports.
- Strong stakeholder communication, ownership, analytical thinking and collaboration across application, infrastructure, security and vendor teams.
- Ability to participate in operational support, planned changes and major-incident activities according to business requirements.
KEY DELIVERABLES
- Stable, secure and supportable technology services with improved availability, performance and operational readiness.
- Timely resolution of complex incidents, complete root-cause analysis and closure of preventive actions.
- High-quality technical designs, implementation evidence, knowledge articles and support documentation.
- Controlled delivery of upgrades, migrations, standardization, automation and service-improvement initiatives.
- Clear technical communication with stakeholders, service owners, partner teams and technology vendors.
SELECTION FOCUS
- Depth of hands-on technical knowledge and ability to explain design and troubleshooting decisions.
- Experience with enterprise-scale operations, critical incidents, controlled changes and service restoration.
- Quality of documentation, automation mindset, security awareness and approach to continuous improvement.
Communication, ownership and ability to work effectively across multiple technical and business teams