Bilal Latif

• Configured, supported, and fine-tuned FortiGate and Palo Alto firewalls, including
security policies, NAT (SNAT, DNAT, VIPs), IPSec/SSL VPNs, and URL filtering.
• Monitored and analyzed network traffic and security logs, collaborating with SOC teams
and serving as an escalation point for complex incidents.
• Designed, updated, and optimized firewall rules and NAT policies, performing policy
ordering, cleanup, and rule hit-count analysis.
• Investigated and resolved application access, network connectivity, and VPN-related
issues using logs, traffic analysis, and packet captures.
• Monitored high-availability (HA) firewalls, interfaces, tunnels, sessions, licensing, and
signature updates, ensuring configuration backups and post-change validation.
• F5 BIG-IP LTM components, including Nodes, Pools, Pool Members, Virtual Servers (VIPs),
profiles, and health monitors to maintain availability and performance.
• Implemented and supported load balancing, traffic steering, iRules/iControl, and
application optimization using OneConnect, persistence, and SSL offloading.
• Performed daily monitoring, incident resolution, change deployments, and failover
testing across network and security platforms.

Security Architecture & Policy Development:
• Designed and managed enterprise firewall security using FortiGate and Palo Alto,
implementing layered security architectures.
• Configured security policies, NAT (SNAT/DNAT/VIPs), and URL filtering to protect critical
business applications.
• Deployed IPSec and SSL VPNs with strong encryption standards, ensuring secure remote
and inter-site connectivity.
• Monitored firewall traffic and security events, coordinating with SOC teams and handling
escalated incidents.
• Performed firewall rule audits, cleanup, hit-count analysis, and policy optimization to
reduce risk.
• Troubleshot application access, VPN failures, and network connectivity issues using logs
and packet captures.
• Managed HA firewalls, monitored sessions, tunnels, licenses, firmware updates, and
configuration backups.
• Administered F5 BIG-IP LTM to securely deliver applications using SSL offloading,
persistence, and traffic steering.

Infrastructure Design & Implementation:
• Incorporate industry-standard security best practices for LAN/WAN, wireless, and firewall
configurations.
• Develop comprehensive technical documentation (HLD, LLD, Migration Plans) for
seamless project execution.
• Conducted complex network migrations with detailed cutover plans, traffic flow analysis,
and fallback procedures ensuring zero service interruption
• Architected resilient network environments utilizing Ruckus ICX switching platforms with
MLAG configurations, dual-homed uplinks, and N+1 power redundancy
• Implemented comprehensive wireless networks supporting 2, 000+ concurrent
connections through Ruckus SmartZone 144 controllers, Unleashed APs, and carefully
planned RF cell overlap (15-20%)
• Deployed Sangfor NGAF/Fortinet/Cisco firewalls with application-level deep packet
inspection, SSL inspection, anti-malware scanning, and granular policy-based routing

Client Engagement & Technical Leadership:
• Spearheaded technical pre-sales activities including site surveys, requirements gathering,
and solution architecture
• Developed detailed technical specifications and bills of materials for enterprise
infrastructure proposals
• Provided high-level technical support achieving 98% first-call resolution rate and rapid
MTTR metrics
• Conducted knowledge transfer sessions and created comprehensive operational
documentation for client IT teams

Security Infrastructure Management:
• Administered FortiGate 400F/600E security appliances in Active-Passive HA configuration
with session synchronization and dedicated heartbeat interfaces
• Developed comprehensive security policies with address objects, service groups, and
application control with deep SSL inspection (certificate pinning exemptions)
• Optimized Sangfor IAG for content filtering (URL categories, keyword blocking) and
bandwidth management (guaranteed/maximum limits) across 1, 000+ users
• Implemented web caching and WAN optimization features to reduce latency for
frequently accessed resources
• Conducted regular security audits (firewall rule audit, unused policy identification) and
vulnerability remediation with 99% closure rate
• Deployed secure remote access infrastructure with SSL VPN web portal, two-factor
authentication, and endpoint security posture checking
• Established site-to-site IPsec tunnels with IKEv2, perfect forward secrecy, and dynamic
routing protocol redistribution

• Deployed multi-vendor network equipment including Cisco Catalyst switches
(2960/3750/4500), Huawei S series switches, and diversified wireless controllers
• Configured site-to-site VPN tunnels with route-based and policy-based approaches,
firewall security zones with customized inspection profiles
• Implemented OSPF multi-area designs with area 0 backbone, stub areas, and proper LSA
filtering for route summarization
• Created detailed RF heat maps with signal strength overlays, interference mapping, and
AP placement optimization using Ekahau Site Survey
• Configured DHCP snooping, Dynamic ARP Inspection, and IP Source Guard as first-hop
security measures