At a glance
- Workplace
- Hybrid
- Location
- Montréal
About the role
- The Principal Network Engineer will lead the technical transformation of the corporate network, serving as the highest-level individual contributor within the network engineering team.
- The role focuses on designing and implementing a Zero Trust Network Access (ZTNA) framework and managing Palo Alto Panorama across a global environment.
- The engineer will collaborate with IAM, Cloud Infrastructure, and Security teams to build a network that enforces identity verification and the principle of least privilege.
Responsibilities
- Act as the technical expert for the ZTNA Network 2.0 program, overseeing architecture, construction reviews, and engineering standards.
- Build and validate ZTNA architecture across global sites, defining network zones and segmentation policies to eliminate lateral movement risk.
- Manage Palo Alto Panorama at scale, including template hierarchies, device groups, and policy distribution.
- Develop cloud integration between AWS and Palo Alto Panorama, unifying cloud-native firewall policies with on-site ZTNA structures.
- Lead the architecture of Palo Alto Cloud Identity Engine (CIE) to migrate IP-based firewall rules to identity-based rules.
- Direct GlobalProtect architecture, including agent configuration, split tunneling, and certificate trust chains.
- Author and maintain network architecture documentation, design decision registers, and operational runbooks.
- Lead global site topology mapping and define support models and hardware refresh sequencing.
- Collaborate with network automation engineers to build self-healing policy frameworks and CI/CD pipelines for network configuration.
- Represent network engineering in cross-functional architecture reviews with IAM, Cloud, and Security teams.
Requirements
- 10+ years of experience in enterprise network engineering with expertise in large-scale architecture design.
- Advanced knowledge of Palo Alto NGFWs and Panorama, including template hierarchies, NAT, and decryption policies.
- Proven experience in ZTNA architecture, including segmentation models and policy logic.
- Deep knowledge of GlobalProtect architecture, gateway configuration, and certificate trust.
- Hands-on experience in AWS network architecture, including VPC, Transit Gateway, Direct Connect, and AWS Network Firewall.
- Understanding of identity-network application models and how identity signals translate to firewall policies.
- Mastery of SD-WAN concepts and Prisma SD-WAN or equivalent solutions.
- Experience writing network architecture documentation and design standards.
- Ability to work autonomously as a reliable contributor without close supervision.
- Excellent communication skills for both technical and non-technical audiences.
Preferred qualifications
- Hands-on experience with Palo Alto Cloud Identity Engine (CIE)
- Deep expertise in network automation using Python, Ansible, or Panorama API scripts
- Experience in GCP network configuration including VPC Service Controls and Cloud Armor
- Experience in a multi-studio, multi-site entertainment or gaming company
- Active PCNSE certification
- Active ZTNA specialist certification
- Active AWS Advanced Networking Specialty certification
Benefits
- Health & Wellness
- Time Off to Recharge
- Financial Well-being
- Life & Family Support
- Volunteer and Community Initiatives
- Learning & Development
- Exclusive Perks
- Annual and long-term incentive programs
Workplace
- Role is based in Montréal.
Skills
- Palo Alto Panorama
- NGFW
- ZTNA
- GlobalProtect
- AWS
- Transit Gateway
- Direct Connect
- AWS Network Firewall
- Prisma SD-WAN
- Python
- Ansible
- CIE
Show all 15 skills
- Okta
- Entra
- CI/CD
