Safebox LLC provides strategic IT leadership, robust security, and operational excellence tailored specifically for mid-market enterprises. We are seeking an Operational Technology (OT) Firewall Engineer / Palo Alto Engineer (English Speaking - remote) to work with our manufacturing client. In this role you will Own the firewall and segmentation workstream of a North American Operational Technology cyber resilience initiative — remotely. Working from discovery data (Claroty or similar) and site survey output, you will baseline actual traffic flows, identify IT/OT security vulnerabilities, remediate existing firewall posture, and design and implement network segmentation aligned to the Purdue model. This role turns discovery findings into enforceable policy — building rulebases that protect Operational Technology assets without breaking the industrial traffic that keeps plants running.
.
Key Responsibilities
- Review discovery data to baseline actual traffic flows, protocols, and asset communications across plant networks; contribute to the IT/OT vulnerability assessment and segmentation recommendation
- Remediate existing firewall posture: rulebase cleanup, removal of overly permissive rules, policy optimization, documented exceptions
- Design and implement network segmentation: Purdue model zones and conduits, IT/OT boundary enforcement, industrial DMZ architecture for plant-to-enterprise data flows
- Build, stage, and deploy Palo Alto NGFW policies (security policy, NAT, App-ID/service-based rules, zone protection, logging standards) managed via Panorama
- Coordinate with the LAN engineer on VLAN/routing changes supporting segmentation; validate policy behavior remotely during cutover windows
- Tune policies for industrial protocols and long-lived Operational Technology sessions; troubleshoot blocked flows affecting PLCs, HMIs, historians, and vendor remote access
- Support implementation events remotely during scheduled maintenance windows (including nights, weekends, holidays); provide hypercare after cutovers
- Produce documentation: segmentation design, rulebase standards, change records, as-built policy documentation
Required Experience:
- 5+ years hands-on firewall engineering, with 3+ years on Palo Alto NGFW (policy design, Panorama, upgrades, troubleshooting)
- Direct experience implementing network segmentation — ideally IT/OT segmentation in manufacturing or industrial environments
- Working knowledge of the Purdue model and Operational Technology security architecture (zones/conduits, industrial DMZ, secure remote access patterns)
- Experience performing firewall rulebase remediation on brownfield environments
- Strong understanding of routing, NAT, and how firewall changes interact with L2/L3 design
- Experience working through secure remote access (jump hosts, PAM) into production environments
- English proficiency sufficient for daily collaboration, documentation, and live cutover bridges with US-based stakeholders
Preferred Experience
- Experience consuming discovery data (Claroty, Nozomi, Dragos, Armis) to build segmentation policy
- Industrial protocol firewall handling: EtherNet/IP, PROFINET, Modbus TCP, OPC UA, DNP3
- Palo Alto certifications (PCNSE preferred; PCNSA acceptable)
- Palo Alto Operational Technology capabilities: IoT/OT Security subscription, industrial App-IDs
- Migration experience from legacy platforms (Cisco ASA, Check Point, Fortinet) to Palo Alto
- ISA/IEC 62443 familiarity
Tools / Technologies
- Palo Alto NGFW, Panorama, PAN-OS
- Claroty or similar Operational Technology discovery platforms
- Expedition or equivalent migration tooling; Wireshark / flow analysis
- Documentation and diagramming tools (Visio or similar)
Soft Skills
- Risk-aware but delivery-oriented — knows when to enforce and when to alert-only during phased rollouts
- Precise change discipline: every rule has an owner, a justification, and a record
- Communicates policy impact in plain language to plant stakeholders who are not security specialists
Work Schedule
- Full-time, aligned to US business hours; flexibility for implementation events in US Pacific and Hawaii–Aleutian time zones
- Overtime, weekend, and holiday work required during implementation and cutover windows
Work Location: fully remote
Engagement Duration
- 6 months full-time initial term; strong potential for extension into remediation, modernization, and ongoing site support
Rate: Up to USD $5,100 gross per month
Important Notes:
- Direct applicants only; no staffing agencies or Corp-to-Corp arrangements.
- Safebox LLC is an equal opportunity employer committed to diversity and inclusion.
- Failure to respond to supplemental questions may result in automatic rejection.
Job Type: Full-time
Pay: $78,932.00 - $89,456.00 per month
Application Question(s):
- Have you previously worked for any US companies? If so, please list them here.
- This role works with customers in English; it is expected that your English communication skills are sufficient. Please confirm and also confirm your submitted resume is in English.
Experience:
- Purdue model: 1 year (Required)
- hands-on firewall engineering: 5 years (Required)
- Palo Alto NGFW: 3 years (Required)
- manufacturing or industrial: 1 year (Required)
Language:
- Advanced English (B2) (Required)
Work Location: Remote
