Firewall Migration & Cutover
Palo Alto and Panorama migrations, rule-base rebuilds, GlobalProtect rollouts, and edge replacements — planned, staged, and cut over in a real change window with a tested rollback.
Independent Engagements
The cutover
goes clean.
Ryan Berroa takes on a small number of firewall, cloud, and network security engagements outside of full-time enterprise work — the migrations, segmentation projects, and edge rebuilds that internal teams do not have the bandwidth or the scar tissue to run alone. 25+ years of enterprise infrastructure, most of it spent making high-risk changes at 2 a.m. without breaking the business.
change window
evenings & weekends
rollback
planned before the first packet moves
2026
Ryan Berroa
CCNP · CCDP · CCNA
What I Take On
The work that
can't go wrong.
Engagements where a mistake takes the business offline — and where the plan matters as much as the config.
Cloud Network Security
Azure, AWS, and OCI network architecture — hub-and-spoke design, transit routing, site-to-site connectivity, and Zero Trust segmentation that holds up after the project ends.
Network Modernization
BGP, OSPF, and SD-WAN across multi-site environments. Redundancy that actually fails over, segmentation that actually contains, and documentation your team can run without me.
Assessment & Remediation
Policy review, rule-base cleanup, remote-access hardening, and compliance evidence — delivered as a prioritized plan with the risky items called out first, not a 90-page export.
Engagement Models
Scoped first.
Then priced.
Assessment
Fixed scope, fixed fee. I review the firewall policy, segmentation, and remote access, then hand back a prioritized remediation plan. Most clients start here.
from $3,500Fixed fee
Project & Cutover
Migration, rebuild, or new deployment — design, build, stage, cut over, and hand off. Priced per project once the scope is real, never before.
from $4,500Per project
Advisory Retainer
A senior engineer your team can escalate to. Design review, second opinions on risky changes, and a standing block of hours each month.
from $2,500Per month
Hourly
For focused work that doesn't need a project wrapper. Evening, weekend, and emergency change windows — which is when most cutovers happen anyway.
from $185Per hour
Every engagement starts with a scoping call — no charge. A detailed rate sheet is available on request.
MSPs & VARs: white-label overflow
If you've won Palo Alto, Azure, or network security work you can't staff this quarter, I take subcontract and white-label delivery under your brand. Your client relationship stays yours. Reach out and we'll set terms.
Proof
Verify before
you hire.
Palo Alto NGFW
Panorama
GlobalProtect
Azure
AWS
Zero Trust
SD-WAN
BGP
Cisco
PowerShell
Python
The Résumé
Full background, current
Every role, platform, and certification listed above is on the record. Read it before the scoping call, not after.
Open the resumeShipped Work
Rynexx · The Reese Firm
Production systems built and maintained outside the day job — the same standard of delivery applied to a different stack.
See the projects
Tell me what
breaks if this
goes wrong.
That's the first question on every call, and it's how the scope gets built. Send the shape of the problem — the platform, the deadline, the blast radius — and I'll tell you honestly whether I'm the right person for it.
Scoping call
30 minutes, no charge. We find out if this is even a fit.
Written scope and price
Fixed number before any work starts. No hourly surprises.
Build, stage, cut over
Executed in your change window, with the rollback already tested.
Handoff
Documentation your team can run without me. That's the point.
Start a Project
Scoping call, no charge.
Messages come straight to my phone. Expect a reply within a day — same day if it's an active outage.