Employment type: Permanent
Location: Buona Vista / Changi / Ayer Rajah
Experience: 3-5 years

Job Description: Firewall Support Engineer

The Firewall Support Engineer is responsible for the day-to-day administration, monitoring, and troubleshooting of the organization's firewall infrastructure. You will handle escalations from L1 and keep mission-critical network security systems available to a 99.9% SLA.

Key Responsibilities

Configure, administer, troubleshoot, and maintain firewalls (Palo Alto, FortiGate, Check Point) and IDS/IPS
Manage firewall rule and policy changes under change control, including periodic rule reviews and cleanup
Raise and manage Change Requests (CRs) for all firewall changes
Diagnose connectivity issues (NAT, routing, VPN, HA failover) using logs, packet captures, and flow tools
Perform root cause analysis on firewall-related issues escalated from L1 to prevent recurrence
Patch firewalls directly in production and perform major firmware upgrades with minimal downtime
Manage signature updates and license renewals
Develop, maintain, and enforce firewall policies, procedures, and runbooks
Work with IT and L3 teams on firewall and network security issues mentor L1 staff
Prepare firewall incident, audit, and system status reports
Join a 24/7 on-call rotation for critical incidents, and be onsite when required

Required Skills and Experience

Bachelor's degree in Information Security, Computer Science, or a related field, or equivalent experience
3-5 years in network security, with L2 support experience
At least 1-2 years supporting mission-critical systems with a 99.9% SLA
Firewall administration: Hands-on, recent experience administering at least one major firewall platform (Palo Alto, FortiGate, or Check Point)
Production patching: Experience applying patches directly to production firewalls
Major upgrades: Experience performing major firewall version upgrades (e.g., across major releases, including HA pairs)
Change management: Experience raising Change Requests (CRs) for firewall changes, including risk assessment, rollback plan, and approvals
Strong grasp of TCP/IP, routing, VPN (IPsec/SSL), NAT, and network security principles
Willingness to work on-call and onsite when required

Good to Have

Vendor certifications: PCNSA/PCNSE, NSE 4, CCSA, or CompTIA Security+
Familiarity with ITSM standards (e.g., ITIL)
Scripting or API automation (Python, Bash)