DFND Security

We are looking for a firewall engineer to help replace PAN/Cisco firewalls with fortinet.  We have tons of sites to do over the next couple months.  Consultants are expected to travel around to local utility sites for 1 day to replace firewalls, config work and the rest of the time for each site is expected to be remote.  

Next 2 locations are Cincinnatus, NY and Chenango Forks, NY

Firewall Engineer (Fortinet Migration – Utilities / Substations)

Role Overview

We are seeking an experienced Firewall Engineer to support a targeted firewall replacement initiative across multiple utility substation locations. This role involves on-site hardware replacement and configuration of legacy firewalls, followed by remote completion of configuration, validation, and documentation tasks.

The engineer will replace existing Cisco ASA and Palo Alto Networks firewalls with Fortinet FortiGate appliances, ensuring secure, reliable, and compliant network operations within critical infrastructure environments.

Key Responsibilities

On-Site (1 Day per Location):

• Travel to designated utility substation sites to perform firewall hardware replacements
• Decommission existing Cisco ASA and Palo Alto firewalls
• Rack, install, and physically connect Fortinet FortiGate appliances
• Perform initial configuration, including:
• Interface setup
• Routing (static and/or dynamic)
• VPN configuration (IPSec)
• Basic security policies
• Coordinate with remote teams for cutover and validation
• Perform initial connectivity and failover testing

Remote (Off-Site Work):

• Complete advanced firewall configuration and rule migration
• Optimize security policies and NAT configurations
• Integrate with centralized management tools (e.g., FortiManager, FortiAnalyzer if applicable)
• Perform post-deployment validation and troubleshooting
• Document configurations, network diagrams, and change records
• Support knowledge transfer and handoff to operations teams

Required Qualifications

• Proven experience with Fortinet FortiGate firewall deployment and configuration
• Strong hands-on experience with Cisco ASA and/or Palo Alto Networks firewalls
• Solid understanding of:
• Layer 3 networking (routing, VLANs, subnetting)
• VPN technologies (IPSec, site-to-site tunnels)
• NAT and firewall policy design
• Experience performing firewall migrations and cutovers in production environments
• Ability to work independently in remote and field environments
• Strong troubleshooting and documentation skills

Preferred Qualifications

• Experience working in utilities, energy, or critical infrastructure environments
• Familiarity with substation networks and OT/ICS environments
• Knowledge of security and compliance frameworks relevant to utilities (e.g., NERC CIP)
• Experience with FortiManager and FortiAnalyzer
• Relevant certifications (e.g., NSE 4/5/7, CCNP Security, PCNSE)

Work Structure

• On-Site Requirement: ~1 day per location for hardware replacement and initial configuration
• Remote Work: Remaining hours performed remotely for configuration, validation, and documentation
• Travel: Required to multiple substation locations (regional travel expected)

Engagement Type

• Contract / Project-based
• Flexible scheduling based on site availability and project timeline