Responsibilities

• Lead the end-to-end design, deployment, and operational management of Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) solutions across complex enterprise environments.
• Manage zero trust network access (ZTNA) transformation workstreams, including the replacement of legacy virtual private network (VPN) infrastructure and modernization of enterprise access controls.
• Provide technical leadership for the configuration and optimization of Zscaler capabilities, including policy administration, SSL/TLS inspection, advanced threat protection, data loss prevention, and cloud-based traffic inspection.
• Oversee the implementation of branch, cloud, and application connector architectures across on-premises and public cloud environments, including Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP).
• Direct the development and quality assurance of technical deliverables, solution architectures, and client-facing recommendations aligned with enterprise security, network transformation, and operational objectives.
• Lead client and delivery teams through execution, managing workplans, risks, dependencies, stakeholder communications, and issue resolution to ensure high-quality outcomes.

Requirements

• BA/BS degree in a technical field (e.g., Computer Science, Cyber Security, Information Technology)
• Zscaler Digital Transformation Engineer (ZDTE) certification required
• 7+ years of progressively responsible experience in network security engineering
• 7+ years of hands-on experience designing, deploying, and managing Zscaler Internet Access (ZIA), including web filtering, DNS security, cloud firewall, bandwidth controls, and advanced threat protection policies in enterprise-scale environments
• 7+ years of hands-on experience designing, deploying, and managing Zscaler Private Access (ZPA), including application segment configuration, access policies, connector deployment, and zero trust network access (ZTNA) architectures replacing legacy VPN infrastructure
• 3+ years of experience designing, deploying, and managing Zscaler Branch Connector, and configuring BGP/static routing configurations and network segmentation, replacing traditional SD-WAN platforms (e.g., Cisco, VMware, Aruba)
• 3+ years of experience designing, deploying, and managing Zscaler Cloud Connector, including deployment within cloud environments (AWS, Azure, and/or GCP), workload-to-internet and workload-to-workload traffic inspection, and integration with cloud-native networking constructs (e.g., VPCs, VNets, Transit Gateways)
• 5+ years of experience configuring and tuning Zscaler advanced security features, including Cloud Sandboxing, Advanced Threat Protection (ATP), Intrusion Prevention (IPS), Cloud Browser Isolation (CBI), and Data Loss Prevention (DLP) policies
• 5+ years of experience implementing and troubleshooting SSL/TLS inspection within ZIA, including certificate management, decryption policy design, bypass rules, and handling of certificate-pinned applications
• 2+ years of experience with Zscaler AI-powered capabilities, including AI-driven policy recommendations, Digital Experience Monitoring (ZDX), and leveraging Zscaler's AI/ML-based threat intelligence for automated threat response

Preferred

• Advanced cybersecurity certifications such as CISSP, CCIE Security, CCNP Security, or GIAC equivalents (e.g., GPEN, GCSA)
• Ability to conduct SASE vendor competitive analysis and advise clients on solution selection based on specific use cases and requirements (e.g., Zscaler vs. Palo Alto Prisma vs. Netskope)
• Ability to conduct Zero Trust Architecture assessments and develop roadmaps aligning Zscaler capabilities to NIST SP 800-207 or CISA Zero Trust Maturity Model frameworks
• Experience integrating Zscaler with SIEM/SOAR platforms (e.g., Splunk, Microsoft Sentinel, Palo Alto XSOAR) via log streaming, API connectors, or syslog for threat detection and incident response workflows
• Experience with Zscaler APIs and automation tooling (e.g., Terraform, Ansible, Python) for provisioning, policy management, and configuration-as-code workflows
• Experience designing and presenting Zscaler solution architectures tailored to client requirements, translating technical concepts for executive and non-technical stakeholders
• Familiarity with identity provider integrations (e.g., Okta, Azure AD, Ping Identity) for SAML/SCIM-based authentication within ZIA and ZPA deployments
• Previous consulting or "Big 4" experience, with a track record of delivering enterprise network security or SASE transformation engagements