horizon3ai - Senior Backend Engineer, Firewall

• Partner with Product to turn firewall effectiveness and tuning ambitions into concrete, buildable requirements. • Translate blue team workflows and pain into prioritized product outcomes, and push back when a proposed feature or agent behavior would not hold up in a real SOC. • Define acceptance criteria for detection, effectiveness, and tuning features, and validate releases against them before customers see them. • Serve as the standing domain reference for Engineering and AI research: available for design reviews, technique questions, and vendor behavior questions. • FIREWALL & NETWORK POLICY DOMAIN EXPERTISE • Own deep, current knowledge of major firewall platforms (i.e. AWS WAF, Palo Alto PAN-OS, Fortinet FortiOS, Cisco Secure Firewall, and Check Point Quantum) at the management console, policy/configuration, traffic and logging, and API levels. • Maintain fluency in how policy evaluation and enforcement work in each product, including rule order, zones, objects, NAT, security profiles, exceptions, and differences between default and hardened configurations. • Define vendor-specific policy semantics so a recommended rule or configuration change has equivalent intent across platforms that model policies differently. • Track platform releases, policy and API changes, new inspection and threat-prevention capabilities, and vendor guidance; keep our supported coverage model current as vendors ship. • Define what a correct firewall tuning recommendation looks like, ex. blocking the validated attack path while preserving legitimate traffic, and evaluate remediation output against that standard. • Partner with the Attack team so attack-path validation, firewall coverage, and remediation guidance stay grounded in current adversary tradecraft and real network behavior. • FIREWALL & NETWORK SECURITY EXPERTISE • 6+ years in firewall engineering, network security, security operations, incident response, or threat hunting, with meaningful time spent as a practitioner rather than an advisor. • Hands-on experience administering and tuning enterprise firewall platforms in production (i.e. Palo Alto PAN-OS, Fortinet FortiGate/FortiOS, Cisco Secure Firewall, or Check Point Quantum) including rulebases, NAT, segmentation, and policy exceptions. • Deep understanding of how network and SOC teams use firewall policy outcomes and traffic/threat logs for triage, containment, and investigation. • Fluency in false-positive and false-negative tradeoffs, overly permissive rules, service-availability risks, and how to assess firewall policy effectiveness and coverage. • Strong working knowledge of MITRE ATT&CK and network-control coverage frameworks, with a clear view of where they help and where they can mislead. • Solid understanding of post-compromise attacker behavior and how it appears in network traffic and firewall telemetry, and how firewall controls can limit command-and-control, lateral movement, and data exfiltration. • PRODUCT & COLLABORATION • Demonstrated experience shaping a product or platform as a domain expert, whether in a security vendor, an internal tooling team, or a detection engineering function. • Ability to influence without authority. You will not manage the engineers or own the roadmap, and you will still be expected to move both. • Exceptional technical writing. Most of your leverage here comes from written artifacts — requirements, methodology docs, labeling guides, tuning content. • Comfort translating between audiences: engineers, AI researchers, product managers, SOC analysts, and executives. • TECHNICAL FLUENCY • Enough scripting ability, ideally Python, to query APIs, inspect telemetry, and prototype an analysis. • Comfort with SQL and with reasoning over large volumes of event and telemetry data.