Position: OT Firewall Engineer – L3 / FortiGate SME

Role Purpose The L3 OT Firewall Engineer/SME will provide advanced FortiGate engineering, complex troubleshooting, security hardening, major change engineering, OT segmentation support, lifecycle management, RCA and Fortinet TAC coordination.

The role will act as the technical escalation point for complex OT firewall issues and will provide engineering governance for the L2 operational team.

Key Responsibilities

- OT Firewall Security & Segmentation
- Develop and review OT firewall security standards.
- Perform OT/IT/DMZ segmentation reviews.
- Provide technical recommendations for OT security-zone design.
- Review and optimize firewall rule bases.
- Identify and remediate Any/Any, redundant, shadow, unused and overly permissive rules.
- Drive policy hardening and least privilege implementation.
- Perform firewall policy optimization.
- Support zero-trust segmentation initiatives where applicable.
- Review security-profile tuning and policy effectiveness.

2.

Advanced Firewall

Engineering

- Own complex FortiGate configuration changes.
- Engineer major firewall changes and migrations.
- Perform major policy restructuring.
- Support firewall consolidation.
- Support major HA changes and redesign.
- Support major FortiOS migration activities.
- Engineer new DMZ/VPN configurations.
- Support complex routing changes associated with firewall operations.
- Review and technically govern significant production changes.

4.

Advanced

Troubleshooting & RCA
- Resolve complex production firewall outages.
- Investigate repeated firewall failures.
- Analyze software defects and process/resource issues.




- Troubleshoot complex packet drops and unexpected session behavior.
- Investigate HA instability.
- Troubleshoot routing convergence and VPN interoperability issues.
- Investigate performance degradation.
- Lead advanced diagnostics and fault-domain analysis.
- Perform technical RCA and define corrective/preventive actions.
- Validate remediation after resolution.
- Fortinet TAC & Vendor Management
- Coordinate complex technical cases with Fortinet TAC.
- Prepare technical evidence, logs and diagnostics for TAC.
- Analyze TAC recommendations and validate proposed fixes.
- Coordinate software defect investigation.
- Drive technical resolution for recurring FortiOS issues.
- Maintain records of vendor escalations and resolutions.
- FortiOS Lifecycle & Vulnerability Management
- Review FortiOS releases and security advisories.
- Perform lifecycle and EOL/EOS assessments.
- Lead major-version upgrade planning.
- Perform compatibility and dependency analysis.
- Define upgrade and rollback strategies.
- Support vulnerability remediation.
- Validate post-upgrade stability.
- Maintain lifecycle and upgrade roadmaps.
- Capacity & Performance
- Perform firewall capacity assessments.
- Analyze CPU, memory and session utilization trends.
- Assess throughput and interface utilization.
- Evaluate VPN and HA capacity.
- Perform firewall growth planning.




- Provide hardware-sizing recommendations.
- Recommend performance optimization and refresh requirements.

8.

Security

Compliance & Hardening
- Conduct firewall rule-base audits.
- Perform rule recertification.
- Identify Any/Any, unused, shadow and expired rules.
- Lead policy-hardening initiatives.
- Review privileged/administrative access.
- Assess configuration compliance.
- Prepare audit evidence.
- Support vulnerability remediation.
- Validate security baseline compliance.
- Maintain firewall lifecycle governance.

Required Technical Skills

- Expert-level FortiGate/FortiOS experience.
- Advanced firewall policy and security architecture knowledge.
- Strong OT/IT/DMZ segmentation experience.
- Advanced NAT, routing and VPN troubleshooting.
- BGP/OSPF and advanced policy-routing knowledge.
- FortiGate HA architecture and complex troubleshooting.
- Advanced packet-flow/session analysis.
- FortiOS upgrade and migration expertise.
- Firewall hardening and rule-base optimization.
- FortiGuard, IPS, Application Control and SSL inspection knowledge.
- Solid RCA and problem-management capability.
- Fortinet TAC case management.
- Strong understanding of production/OT change management.
- Ability to lead complex technical incidents and major changes.
- Strong documentation and technical governance skills.

Experience

Recommended: 7–10 years of network-security/firewall experience with 5+ years of strong FortiGate engineering experience, including complex enterprise/OT environments.

Certifications – Preferred

- Fortinet FCX – Fortinet Certified Expert
- OT/ICS security certification is an advantage.

📌 Sr. Consultant - Fortigate Job (Pune)
🏢 Yash Technologies
📍 Pune