Senior Network Security Engineer

Who We Are

Applied Materials is the global leader in materials science and engineering solutions that are at the foundation of virtually every new semiconductor chip and advanced display in the world. The equipment that we create and service is essential to advancing AI and accelerating the commercialization of next-generation semiconductor chips. Join us and push the boundaries of materials science and engineering in a company at the foundation of the electronics industry. The work we do together advances the world’s technology.

What We Offer

Salary:

$152,000.00 - $208,500.00

Location:

Santa Clara,CA

You’ll benefit from a supportive work culture that encourages you to learn, develop, and grow your career as you take on challenges and drive innovative solutions for our customers. We empower our team to push the boundaries of what is possible—while learning every day in a supportive leading global company. Visit our Careers website to learn more.

At Applied Materials, we care about the health and wellbeing of our employees. We’re committed to providing programs and support that encourage personal and professional growth and care for you at work, at home, or wherever you may go. Learn more about our benefits.

Summary

The Senior Network Security Engineer is a hands-on technical leader responsible for designing, implementing, securing, and operating enterprise firewall and network security infrastructure across data centers, manufacturing, OT, R&D, campus, and cloud environments. The primary focus of this role is Palo Alto Networks firewall architecture, engineering, policy governance, lifecycle management, and security posture optimization, with supporting expertise in Fortinet, SSE/SASE, Zero Trust, cloud security, routing, and security automation.

Job Description

Applied's IT organization has a long reputation of being a great place to work. The IT team has been recognized as one of Computerworld's 100 Best Places to Work in IT. In addition, numerous Applied IT leaders have been honored as CIO Magazine's Ones to Watch or Computerworld Premier 100 IT leaders.

We are seeking a Senior Network Security Engineer with deep expertise in enterprise firewall architecture and engineering to design, implement, secure, and continuously improve Applied Materials' global network security infrastructure.

This role is hands-on and highly technical, with primary responsibility for Palo Alto Networks NGFW, Panorama, Strata Cloud Manager, firewall policy architecture, security controls, lifecycle management, advanced troubleshooting, and automation across global data centers, manufacturing facilities, campuses, R&D, OT, and cloud environments.

The role partners closely with cybersecurity, cloud, network, OT, application, and infrastructure teams to deliver secure, resilient, scalable, and standardized network security services.

Core Competencies

• Expert-level experience in enterprise network security and firewall technologies within large, global environments.
• Deep hands-on expertise with Palo Alto Networks NGFW, PAN-OS, Panorama, Strata Cloud Manager, PA-Series and VM-Series.
• Experience with Fortinet FortiGate, Forti Manager, and Forti Analyzer is preferred.
• Strong experience architecting and governing enterprise firewall rule bases, security policies, NAT, segmentation, policy lifecycle, recertification, and rule optimization.
• Deep knowledge of App-ID, User-ID, Device-ID, Security Profiles, SSL/TLS Decryption, Advanced Threat Prevention, IPS, URL Filtering, DNS Security, and WildFire.
• Experience with firewall posture and policy-management solutions including Palo Alto AIOps/BPA, SCM, Skybox, and Tufin.
• Expertise in high-availability firewall architectures using Active/Passive, Active/Active, HA clustering, ECMP, VSYS/VDOM, and multi-tenancy.
• Strong understanding of TCP/IP, Ethernet, BGP, OSPF, EIGRP, IPsec, VLANs, HSRP, QoS, Multicast, ACLs, MPLS, SD-WAN, and VPN technologies.
• Advanced troubleshooting and packet-analysis experience using PAN-OS packet diagnostics, session analysis, global counters, flow diagnostics, and Wireshark.
• Experience with SSE/SASE, Zero Trust, SWG, CASB, ZTNA, DLP, and Remote Browser Isolation, preferably using Prisma Access and Zscaler ZIA/ZPA.
• Experience securing Azure, AWS, and GCP environments using Palo Alto VM-Series, Cloud NGFW, and cloud-native controls.
• Experience integrating network security platforms with SIEM/XDR/SOAR solutions including Splunk and Google Chronicle
• Ability to independently solve complex Layer 3 through Layer 7 security problems and provide technical leadership to other engineers.

Key Responsibilities

1. Firewall Engineering & Architecture

• Design, implement, and support global Palo Alto Networks firewall infrastructure, including PA-Series, VM-Series, Panorama, and Strata Cloud Manager.
• Design resilient firewall architectures across data center, campus, manufacturing, OT, R&D, and cloud environments.
• Define global firewall reference architectures, configuration standards, security baselines, and deployment patterns.
• Engineer HA, routing, NAT, VPN, segmentation, PBF, ECMP, VSYS, virtual routing, and multi-tenancy architectures.
• Define Panorama device-group, template, and template-stack architectures.
• Support Fortinet firewall infrastructure where required.

2. Firewall Policy & Security Controls

• Architect and govern enterprise firewall rule structures, policy hierarchy, objects, naming standards, and lifecycle processes.
• Lead firewall rule base optimization and migration from port-based policies to application- and identity-based policies.
• Design and implement App-ID, User-ID, Device-ID, Security Profiles, SSL/TLS Decryption, IPS, Advanced Threat Prevention, DNS Security, URL Filtering, and WildFire.
• Reduce unused, duplicate, shadowed, overly permissive, and high-risk firewall policies.
• Establish firewall policy recertification, ownership, change-control, and compliance processes.
• Perform configuration and security posture reviews using SCM, Palo Alto BPA/AIOps, Skybox, Tufin, and CIS benchmarks.

3. Firewall Lifecycle & Operational Excellence

• Own PAN-OS and FortiOS lifecycle management, software upgrades, hardware refresh, vulnerability remediation, capacity planning, and performance optimization.
• Lead advanced troubleshooting of complex firewall, routing, NAT, VPN, decryption, application, and connectivity issues.
• Perform packet captures, session analysis, flow diagnostics, and Root Cause Analysis for major incidents.
• Serve as a senior escalation point for critical network security incidents and infrastructure outages.
• Develop operational standards, runbooks, health checks, KPIs, and engineering documentation.

4. SSE, SASE & Zero Trust

• Design and support SSE/SASE architectures leveraging Prisma Access and Zscaler ZIA/ZPA.
• Engineer SWG, CASB, ZTNA, DLP, Remote Browser Isolation, private application access, and cloud-delivered security controls.
• Support secure remote access for employees, contractors, and third parties using identity, device posture, and Zero Trust principles.
• Integrate security platforms with Microsoft Entra ID, Okta, SAML, SCIM, Cloud Identity Engine, EDR, and device-posture services.
• Support modernization and replacement of legacy VPN architectures with ZTNA where appropriate.

5. Cloud Network Security

• Architect network security across Azure, AWS, and GCP.
• Design and operate Palo Alto VM-Series and Cloud NGFW deployments.
• Secure hybrid-cloud traffic using Azure ExpressRoute, AWS Direct Connect, VPNs, Transit Gateway, Virtual WAN, hub-and-spoke architectures, and centralized inspection.
• Implement network segmentation and Zero Trust controls across on-premises and cloud environments.
• Partner with cloud teams to integrate firewall services with cloud-native routing, security groups, load balancers, DNS, and identity services.

6. Security Monitoring & Incident Response

• Integrate firewall telemetry with enterprise SIEM/XDR/SOAR platforms.
• Engineer logging and telemetry using Syslog, CEF, APIs, and cloud integrations.
• Support security investigations, incident containment, threat analysis, and remediation.
• Partner with Security Operations to improve firewall-based detection and response capabilities.
• Develop monitoring, dashboards, alerts, and operational security metrics.

7.  Technical Leadership & Project Delivery

• Lead global initiatives including firewall modernization, segmentation, data center migrations, cloud security transformation, SSE/SASE adoption, and Zero Trust programs.
• Develop HLDs, LLDs, implementation plans, test plans, migration plans, rollback plans, and operational runbooks.
• Lead complex security projects from architecture through implementation and operational handoff.
• Evaluate new technologies, lead proof-of-concepts, and provide platform recommendations.
• Mentor engineers and establish technical standards and engineering best practices.
• Present architecture, risk, project status, and technology recommendations to IT and cybersecurity leadership.

8.  Governance, Risk & Compliance

• Ensure firewall and network security controls align with corporate security requirements and frameworks including NIST CSF, ISO 27001, CIS Controls, and applicable export-control requirements.
• Lead firewall rule recertification, configuration audits, security assessments, and vulnerability-remediation activities.
• Identify and document network security risks and drive remediation with technical and business stakeholders.
• Maintain auditable firewall standards, configuration baselines, and security-control documentation.

Functional Knowledge

• Demonstrates expert conceptual and practical knowledge of firewall and network security technologies with broad knowledge of networking, cloud, identity, endpoint, and security operations.
• Applies industry best practices and emerging technologies to improve enterprise network security services.

Business Expertise

• Understands business and technical requirements within a large global enterprise and translates them into scalable, secure, resilient, and cost-effective network security solutions.
• Evaluates security, operational, technology, and business risks when making architecture decisions.

Leadership

• Provides technical leadership and guidance to engineers and cross-functional teams.
• Leads complex global network security projects with significant technical scope and risk.
• Influences architecture, engineering standards, security policy, and technology direction.

Problem Solving

• Solves highly complex Layer 3 through Layer 7 network security problems.
• Uses packet analysis, telemetry, logs, threat intelligence, and multiple sources of technical information to identify root cause and implement sustainable solutions.

Impact

• Directly impacts the security, availability, resiliency, and performance of Applied Materials' global network infrastructure and business-critical services.
• Establishes standards and architectures that influence network security implementations across global environments.

Interpersonal Skills

• Communicates complex technical and security topics clearly to engineers, cybersecurity teams, application owners, business stakeholders, vendors, and leadership.
• Builds consensus across global and cross-functional organizations.
• Demonstrates strong technical documentation and presentation skills.

Required Qualifications

• 8+ years of enterprise Network Security Engineering experience.
• 5+ years hands-on Palo Alto Networks experience in architecture, deployment, engineering, or advanced operations.
• Expert knowledge of PAN-OS, Panorama, App-ID, User-ID, NAT, SSL Decryption, Security Profiles, Threat Prevention, VPN, and security-policy management.
• Strong experience with enterprise firewall architecture, policy governance, and lifecycle management.
• Expert knowledge of TCP/IP, BGP, OSPF, routing, VPN, and network segmentation.
• Advanced firewall troubleshooting and packet-analysis capabilities.
• Experience designing secure, highly available network architectures.
• Experience with enterprise cloud and hybrid-cloud environments.
• Experience leading complex infrastructure or security projects.
• Strong analytical, documentation, communication, and stakeholder-management skills.

Preferred Qualifications

• Experience with Fortinet FortiGate/FortiManager/FortiAnalyzer.
• Experience with Strata Cloud Manager, Palo Alto AIOps/BPA, Skybox, or Tufin.
• Experience deploying firewalls in Azure, AWS, and/or GCP.
• Experience with Prisma Access and/or Zscaler ZIA/ZPA.
• Experience with SIEM/XDR/SOAR integrations.
• Experience with OT/manufacturing network security and segmentation.
• Experience within large-scale, globally distributed enterprise environments.

Education & Experience

• Bachelor's Degree in Computer Science, Engineering, Information Technology, Cybersecurity, or related field required.
• 8–12 years of relevant experience in network and network security engineering.

Certifications

Highly Preferred

• Palo Alto Networks PCNSE
• CISSP

Preferred / Plus

• CCNP Security / CCIE Security
• Fortinet certifications
• Zscaler certifications
• Microsoft Azure networking/security certifications
• AWS Advanced Networking / Security certifications

Additional Information

Time Type:

Full time

Employee Type:

Assignee / Regular

Travel:

Yes, 10% of the Time

Relocation Eligible:

No

The salary offered to a selected candidate will be based on multiple factors including location, hire grade, job-related knowledge, skills, experience, and with consideration of internal equity of our current team members. In addition to a comprehensive benefits package, candidates may be eligible for other forms of compensation such as participation in a bonus and a stock award program, as applicable.

For all sales roles, the posted salary range is the Target Total Cash (TTC) range for the role, which is the sum of base salary and target bonus amount at 100% goal achievement.

Applied Materials is an Equal Opportunity Employer. Qualified applicants will receive consideration for employment without regard to race, color, national origin, citizenship, ancestry, religion, creed, sex, sexual orientation, gender identity, age, disability, veteran or military status, or any other basis prohibited by law.