Senior Technical Consultant - CISCO Security

Key Responsibilities -- Firewall

• Design and deploy Cisco Secure Firewall Threat Defense (FTD) managed by Firewall Management Center (FMC), including high-availability pairs, threat policies (Snort IPS, malware defense, URL filtering), and both site-to-site and remote access VPN configurations.

• Configure and manage Palo Alto Networks next-generation firewalls running PAN-OS, including security profiles (Antivirus, Anti-Spyware, Vulnerability Protection, WildFire), App-ID, User-ID, SSL/TLS decryption, and centralized management via Panorama.

• Lead firewall migration projects including legacy Cisco ASA to FTD conversions, cross-vendor migrations (Check Point, Fortinet, Juniper to Palo Alto or Cisco), and policy translation with rule optimization during cutover.

• Design network segmentation architectures using firewall zones, virtual routers, VRFs, and policy-based routing to enforce least-privilege east-west and north-south traffic controls.

• Deploy cloud-native firewall solutions including Palo Alto Cloud NGFW for AWS and Azure, and Cisco Secure Firewall Cloud Native for containerized and cloud workload environments.

• Implement firewall high availability designs including active/standby failover, active/active clustering, and multi-context deployments for service provider and large enterprise environments.

• Configure centralized logging, SIEM integration (Splunk, Microsoft Sentinel, syslog), and NetFlow/IPFIX for traffic analytics, threat correlation, and compliance reporting.

• Perform firewall rule base optimization, policy cleanup, and compliance auditing to reduce attack surface and align with regulatory frameworks (PCI-DSS, HIPAA, NIST).

• Integrate Cisco Secure Firewall with Cisco XDR for cross-platform threat detection, event correlation, and automated incident response across the security portfolio.

• Automate firewall provisioning, configuration backup, and policy deployment using infrastructure-as-code tools (Terraform, Ansible) and vendor APIs for repeatable, auditable workflows.

Key Responsibilities -- Cisco ISE

• Deploy Cisco Identity Services Engine (ISE) for 802.1X wired and wireless authentication, MAC Authentication Bypass (MAB), and RADIUS/TACACS+ device administration across campus, branch, and data center environments.

• Design and implement ISE authorization policies including Security Group Tags (SGTs) with TrustSec, downloadable ACLs (dACLs), VLAN assignment, and Adaptive Network Control (ANC) for dynamic threat response.

• Configure ISE profiling services, posture assessment, and compliance enforcement to provide endpoint visibility and ensure devices meet organizational security baselines before granting access.

• Integrate ISE with Cisco network infrastructure (Catalyst switches, wireless LAN controllers, Secure Firewall) and third-party network access devices for consistent policy enforcement across heterogeneous environments.

• Deploy ISE guest portals, BYOD onboarding workflows, and certificate-based authentication (EAP-TLS) with internal or external certificate authorities for secure device enrollment.

• Implement pxGrid integrations to share identity and session context between ISE, Cisco Secure Firewall, Splunk, and third-party security platforms for unified policy enforcement and threat intelligence.

• Design ISE distributed deployments spanning Policy Administration Nodes (PAN), Policy Service Nodes (PSN), and Monitoring and Troubleshooting Nodes (MnT) for scale, redundancy, and geographic distribution.

• Perform ISE upgrades, migrations (legacy ACS to ISE), and advanced troubleshooting using RADIUS live logs, policy trace, TCP dump, and debug utilities to resolve authentication and authorization issues.

Key Responsibilities -- SASE / Zero Trust

• Design and implement SASE and Zero Trust architectures covering remote user, branch office, cloud workload, and data center connectivity use cases with a unified security policy framework.

• Configure and deploy Zscaler Internet Access (ZIA) including Secure Web Gateway, SSL inspection, URL filtering, cloud firewall, and sandbox policies, and Zscaler Private Access (ZPA) including ZTNA application segments, App Connectors, and browser-based access.

<li aria-setsize="-1" data-leveltext="" data-font="Symbol" data-listid="10" data-list-defn-props="{"335552541":1,"335559683":0,"335559684":-2,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="21"