SRX

I have an SRX240 which is acting as a router to a third party. I also have a video encoder on IP 172.31.253.2/27.

I need to change the IP of this device before routing it to the third party:

+------------------+       +---------------+        +-------------+       +---------------------------------+
|     Encoder      +------->    SRX240     +-------->Change IP to +-------> Route to third party            |
| 172.31.253.2/27  |       |172.31.253.1/27|        |10.10.10.10  |       | 10.100.0.1/30 --> 10.100.0.2/30 |
+------------------+       +---------------+        +-------------+       +---------------------------------+

So, how do I perform a NAT before routing it out of an interface? Is this even possible?

No, this is not possible.  Check the packet flow process diagram here for reference on where nat, policy and route lookup operations occur.

https://kb.juniper.net/InfoCenter/index?page=content&id=kb16110

Thank. So the only option is to either 1) Put another router in front of the device or 2) change the IP of the actual device

Sorry, I think I read your question incorrectly the first time.  I thought you were asking if you can perform NAT before the route lookup of the flow.

But looking again I see you want to do normal source NAT before forwarding to the same destination address.  That process is outlined on page 6 of these nat examples.

https://kb.juniper.net/library/CUSTOMERSERVICE/technotes/Junos_NAT_Examples.pdf

It's hard to tell from that PDF, but I think that this is forwarding on the same subnet as the "untrusted" interface, I want to NAT it to a new IP address and then use the route to the next hop.

Here's an example.  The nat rule will use the zone of the ingress 3rd party device interface as from and the egress interface zone as the to address with the pool address of your chosen address.

set  security nat source pool src_pool address 10.10.10.10/32
set  security nat source rule-set rs1 from zone trust   <<<< this will be the zone 172.31.253.2/27 is connected to
set  security nat source rule-set rs1 to zone untrust    <<<< this will be the zone 10.100.0.1/30 is connected to
set  security nat source rule-set rs1 rule r1 match source-address 0.0.0.0/0
set  security nat source rule-set rs1 rule r1 match destination-address 0.0.0.0/0
set  security nat source rule-set rs1 rule r1 then source-nat src_pool

the security policy will use and address object for the device and allow any port and destination.  Or you can also restrict these too.

change trust and untrust to match the zones those on the interfaces already.

set security zone security-zone trust address-book address 3rd-party 172.31.253.2/32
set security policies from-zone trust to-zone untrust policy 3rdparty-access match source-address 3rd-party destination-address any application any
set security policies from-zone trust to-zone untrust policy 3rdparty-access then permit