Firewall Support Engineer

Employment type: Permanent
Location: Buona Vista / Changi / Ayer Rajah
Experience: 3-5 years

Job Description: Firewall Support Engineer

The Firewall Support Engineer is responsible for the day-to-day administration, monitoring, and troubleshooting of the organization’s firewall infrastructure. You will handle escalations from L1 and keep mission-critical network security systems available to a 99.9% SLA.

Key Responsibilities

• Configure, administer, troubleshoot, and maintain firewalls (Palo Alto, FortiGate, Check Point) and IDS/IPS
• Manage firewall rule and policy changes under change control, including periodic rule reviews and cleanup
• Raise and manage Change Requests (CRs) for all firewall changes
• Diagnose connectivity issues (NAT, routing, VPN, HA failover) using logs, packet captures, and flow tools
• Perform root cause analysis on firewall-related issues escalated from L1 to prevent recurrence
• Patch firewalls directly in production and perform major firmware upgrades with minimal downtime
• Manage signature updates and license renewals
• Develop, maintain, and enforce firewall policies, procedures, and runbooks
• Work with IT and L3 teams on firewall and network security issues; mentor L1 staff
• Prepare firewall incident, audit, and system status reports
• Join a 24/7 on-call rotation for critical incidents, and be onsite when required

Required Skills and Experience

• Bachelor’s degree in Information Security, Computer Science, or a related field, or equivalent experience
• 3-5 years in network security, with L2 support experience
• At least 1-2 years supporting mission-critical systems with a 99.9% SLA
• Firewall administration: Hands-on, recent experience administering at least one major firewall platform (Palo Alto, FortiGate, or Check Point)
• Production patching: Experience applying patches directly to production firewalls
• Major upgrades: Experience performing major firewall version upgrades (e.g., across major releases, including HA pairs)
• Change management: Experience raising Change Requests (CRs) for firewall changes, including risk assessment, rollback plan, and approvals
• Strong grasp of TCP/IP, routing, VPN (IPsec/SSL), NAT, and network security principles
• Willingness to work on-call and onsite when required

Good to Have

• Vendor certifications: PCNSA/PCNSE, NSE 4, CCSA, or CompTIA Security+
• Familiarity with ITSM standards (e.g., ITIL)
• Scripting or API automation (Python, Bash)