Network Security Engineer

McGough•Roseville, MN

3d•$95,000 - $110,000

About The Position

The Network Security Engineer designs, implements, and operates the company’s Zscaler environment and related network security controls. This hands-on role applies zero-trust, secure access, traffic inspection, data protection, identity, cloud, and segmentation controls across enterprise users, applications, and workloads. The position partners with Network Engineering, Security Operations, Cloud Platform, Identity, Application Security, and business technology teams. Work is primarily performed in an office or remote-work environment using standard computer and collaboration tools. Periodic after-hours support, on-call participation, and up to 10% travel may be required. The base salary range is $95,000 to $110,000, excluding fringe benefits or potential bonuses. Final base salary depends on factors including geography, location, skills, education, and experience. McGough offers a compensation and benefits package that includes medical, dental, vision, life, and disability insurance; retirement plans; voluntary benefit plans; parental leave; paid time off; and holiday pay.

Requirements

At least 2 years of network, cloud, or security engineering experience, including significant production experience with Zscaler ZIA, ZPA, and Client Connector.
Strong knowledge of TCP/IP, routing, DNS, HTTP/S, TLS, certificates, proxies, GRE, IPsec, identity federation, device posture, CASB, and DLP.
Experience designing secure internet, SaaS, private-application, and cloud-workload connectivity in at least one major public-cloud platform.
Experience integrating network security platforms with identity, endpoint, certificate, SIEM, and incident-response systems.
Advanced troubleshooting of routing, authentication, certificates, proxies, application connectivity, traffic forwarding, and performance issues.
Ability to translate security and connectivity requirements into practical, identity- and risk-based policies.
Strong documentation, project ownership, communication, and cross-functional collaboration skills.
Ability to balance security, user experience, application performance, and business needs.

Nice To Haves

Experience with Zscaler Cloud Connector, Zero Trust Gateway, ZDX, Browser Isolation, Cloud NSS, or related Zscaler capabilities.
Experience with Terraform, Python, PowerShell, REST APIs, Git, or CI/CD automation.
Zscaler, cloud, networking, or security certifications.

Responsibilities

Design, implement, administer, and troubleshoot ZIA, ZPA, Client Connector, App Connectors, traffic forwarding, TLS inspection, secure web gateway, firewall, threat protection, CASB, and DLP controls.
Secure employee access to internet, SaaS, and private applications using identity-, device-, risk-, and data-aware policies.
Design secure connectivity and segmentation for on-premises and cloud workloads, private applications, administrative services, and machine-to-machine communications.
Integrate Zscaler with identity, endpoint, cloud, certificate, SIEM, and incident-response platforms.
Develop and maintain the target architecture and roadmap for Zscaler, zero-trust networking, secure access, and cloud workload protection.
Partner with business and technical stakeholders to assess user and application access, traffic and data flows, availability needs, performance, and security requirements.
Develop, test, document, and maintain access, data-protection, traffic-inspection, segmentation, and exception policies.
Govern internet, SaaS, and private-application access and protect source code, credentials, intellectual property, customer information, and other sensitive data.
Monitor Zscaler logs and develop alerts for threats, sensitive-data exposure, policy bypass, anomalous traffic, and administrative changes.
Report on platform health, traffic trends, policy effectiveness, exceptions, incidents, and remediation progress.
Automate configuration, validation, reporting, and compliance activities using APIs, scripting, or infrastructure-as-code tools.
Maintain architecture diagrams, operational procedures, troubleshooting guides, and incident-response runbooks.