Reach Security - Principal Support Engineer

• The experience below is the foundation we're hiring for. You've done this work hands-on, at depth, earlier in your career — and in this role you'll leverage that judgment as a subject-matter expert rather than performing it day to day. We're screening for the expertise that experience produced, not for a desire to keep administering networks. • 6+ years of deep, hands-on experience with enterprise network security — firewalls, segmentation, and network traffic analysis — enough to have developed genuine expertise, not passing familiarity. • Time in a senior individual-contributor role such as L3 Network Support Engineer, Network Security Engineer, Firewall Engineer, or Security Support Engineer. • Platform-level expertise with one or more enterprise firewall ecosystems — Palo Alto (PAN-OS), Fortinet FortiGate, Cisco (ASA/Firepower), Check Point, or Juniper — including rule-base design, review, and optimization, and the judgment to know what “good” looks like. • Strong command of TCP/IP and network protocol internals, with the ability to reason from packet captures (Wireshark/tcpdump), flow/telemetry data, and device logs to root cause. • Depth in network segmentation and micro-segmentation, NAT, routing (BGP/OSPF), VPN (IPsec/SSL), and TLS/SSL inspection. • Experience with IDS/IPS/NDR, secure web gateways/proxies, DNS security, and modern SASE/ZTNA architectures. • Cloud network security experience — AWS security groups/NACLs, Azure NSGs, GCP firewall rules, VPCs, and connectivity/peering constructs. • A track record resolving interoperability issues between network-security tools and the broader stack. • Working knowledge of Linux system administration, sufficient to reason about the services that collect from and integrate with network devices. • Experience with enterprise-scale, multi-site environments and large, heterogeneous network estates. • The advisory instinct that defines this role: the ability to look at a rule-base or a set of findings and tell a customer, clearly, which few things matter and why. • Strong written and verbal communication — you can make a complex network issue clear to a customer, an SE, and an engineer, each in their own language. • Strong time management and a real sense of urgency in customer-impacting situations. • BS or MS in Computer Science, Engineering, Networking, or a related technical discipline — or equivalent practical experience. • Cross-domain fluency we value • Reach spans the whole security stack, and the best domain experts are curious well past their specialty. You don't need to be an expert in all of these, but comfort in several will make you far stronger here: identity and IDP troubleshooting (SSO, SAML/OIDC, and layered/conditional access as it intersects network controls); a working grasp of threats and vulnerabilities and how they map to exposure at the network layer; and familiarity with email security controls. We'll gladly help you deepen the areas you're newer to. • Relevant certifications (e.g., PCNSE, NSE, CCNP/CCIE Security, CISSP) — valued as evidence of depth, not required. • Experience with WAF, load balancers, and application-layer security. • Familiarity with network detection/analytics, SIEM, or SOAR platforms from a support or troubleshooting perspective. • Scripting/automation for network validation and troubleshooting (Python, or platform APIs). • Exposure to hybrid and multi-cloud connectivity (transit gateways, SD-WAN, cloud firewalls). • Who you'll thrive as • You're the person peers escalate to — and still the first to say “that's a strange packet, let me chase it down.” You think in systems, you're relentless about root cause, and you're generous with what you learn. You're as comfortable teaching an SE how to defend a rule-base finding as you are staring at a capture until the anomaly gives itself up. Curiosity, adaptability, and low ego matter to us as much as depth: the security stack keeps changing, and we're looking for someone who's genuinely excited by that. • Working at Reach Security: