Sr Lead Network Security Engineer - Zero Trust

ADP • Alpharetta, GA

7d • Hybrid

About The Position

ADP is seeking a Senior Lead Network Security Engineer to join its Global Security Organization. The role brings deep network engineering experience to the governance and strengthening of Security Service Edge (SSE) controls that protect associate and server access to the internet and SaaS applications. The engineer will work with platforms such as Palo Alto Networks Prisma Access, Zscaler, and Fortinet, as well as associated firewall and proxy controls.

This position is for an experienced network security engineer or architect who will broaden their impact beyond direct platform administration and contribute to technical security governance. The role remains hands-on in traffic analysis, troubleshooting, policy assessment, and remediation validation, while shaping enterprise security decisions. In partnership with infrastructure owners, the engineer defines security requirements and drives corrective action through established change processes.

The role protects company and client data from exploitation or misuse and influences network and cloud engineering teams as they develop, deploy, and maintain security controls. It provides technical leadership to modernize internet policies, identify weak controls, engineer mitigations, and reduce operational risks associated with data in motion and at rest. The engineer also supports security and compliance initiatives, improves control effectiveness and maturity, and ensures network security initiatives adhere to changing privacy and legal requirements.

Requirements

• Bachelor’s degree or equivalent.
• 10+ years of progressive experience in network security engineering, security architecture, or related infrastructure security roles, including substantial hands-on enterprise troubleshooting and policy administration.
• Practical expertise with Palo Alto Networks, Zscaler, Netskope, Broadcom/Symantec, Fortinet, or comparable firewall, proxy, or SSE platforms, and ability to apply that experience to Prisma Access.
• Strong grounding in TCP/IP, routing, NAT, DNS, HTTP/HTTPS, TLS inspection, certificates, VPNs, endpoint connectivity, proxy architectures, and internet egress.
• Experience with GlobalProtect or comparable clients, explicit and transparent proxies, PAC files, and user-to-workload traffic flows.
• Experience managing global policy exceptions, URL categories, application controls, rule reviews, and least-privilege access; ability to distinguish policy intent from observed enforcement.
• Working knowledge of DLP, CASB/SaaS discovery, IDS/IPS, malware prevention and sandboxing, protective DNS, threat intelligence, WAF, and DDoS controls, including how these layers interact.
• Strong understanding of data security, encryption, privacy by design, and secure logging and monitoring practices.
• Strong knowledge of security frameworks and standards such as OWASP ASVS, SAMM, NIST 800-53, NIST CSF, ISO 27001, and CIS Controls.
• Demonstrated ability to influence cross-functional teams, coordinate urgent technical investigations, and balance tactical response with strategic improvement.
• Ability to turn incomplete or conflicting evidence into a clear technical hypothesis, defensible recommendation, and verified remediation outcome.
• Excellent interpersonal and communication skills, emotional intelligence, disciplined follow-through, and close attention to technical and procedural detail.

Nice To Haves

• Prisma Access or comparable SASE experience.
• SaaS discovery and AI governance experience.
• API or scripting automation experience.
• SIEM and ServiceNow experience.
• Relevant security or networking certifications.
• Experience operating and managing Palo Alto Networks SASE solutions, next-generation firewalls, and core product features.
• Certifications such as CISSP, CISM, CCSP, CSSLP, CEH, SANS/GIAC certifications, or Palo Alto Networks Certified Network Security Administrator (PCNSA).

Responsibilities

• Assess secure web gateway (SWG), next-generation firewall, URL filtering, SaaS inline, and related SSE controls against company policies and standards; identify configuration, coverage, and enforcement gaps.
• Govern access exceptions, allow/block lists, inspection exclusions, and rule lifecycle reviews, confirming business justification, least privilege, ownership, expiration, and approval evidence.
• Evaluate new platform capabilities and vendor limitations; define acceptance criteria and validate that deployed controls achieve intended security outcomes.
• Lead assessments of enterprise internet egress, including forward-proxy firewalls, explicit proxies, PAC configurations, and alternate routes for associate and server workloads.
• Correlate traffic logs, policy configurations, identity, and application dependencies to identify access paths that result in inconsistent enforcement or bypass required SSE controls.
• Partner with Global Network Solutions to rationalize legacy egress, close unauthorized access paths, and align approved exceptions with enterprise standards while preserving required business connectivity.
• Investigate complex access issues, suspected vulnerabilities, and control failures using packet captures, session and threat logs, policy matching, DNS analysis, and TLS inspection evidence.
• Lead technical triage with network, digital workspace, security, application-owner, and vendor partners; define containment and corrective actions, assign owners, and validate resolution.
• Use SaaS discovery, application risk signals, and DLP insights to identify unsanctioned applications, risky AI usage, and potential data exposure; coordinate investigations with accountable teams.
• Improve SaaS discovery, categorization, and inline controls, connecting findings to application intake, governance decisions, exception processes, and enforceable access requirements.
• Partner with SaaS Governance, AppSec, Privacy, and Legal to implement approved access decisions and location-specific requirements.
• Provide senior technical direction, mentor engineers and analysts, and improve the quality and consistency of team investigations without relying on direct reporting authority.
• Convene working sessions and escalation calls, resolve competing priorities, and communicate immediate actions alongside longer-term corrective plans.
• Maintain technical documentation, audit evidence, and metrics for enforcement coverage, exception aging, alternate egress findings, and remediation progress; explain business impact to leadership.
• Drive discovery and prioritization of data-control remediation to meet audit, compliance, and network data-protection requirements, policies, and standards.
• Assess endpoint and data security control effectiveness and drive improved effectiveness, consistency, and maturity across the organization.

Benefits

• ADP Philanthropic Foundation support for associates in times of need.
• A collaborative environment that encourages learning, ownership, and community giving.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior