Zero Trust Implementation Lead

TEKsystems•Greensboro, NC

3d•$67 - $83•Hybrid

About The Position

The Zero Trust Implementation Lead is a hands-on security engineering contractor responsible for accelerating execution of an enterprise Zero Trust program across global retail, corporate office, distribution center, and data center environments. The role implements, configures, tests, troubleshoots, cuts over, and operationalizes Zscaler access technologies and enterprise network segmentation platforms, working directly with application owners and infrastructure, networking, identity, endpoint, security operations, site operations, and vendor teams. It drives technical workstreams from discovery through production acceptance, resolves implementation barriers, and produces complete operational and audit-ready documentation. The work includes implementing least-privilege, identity-aware, application-specific access controls; migrating eligible applications to Zscaler Private Access (ZPA) or Browser Access; reducing direct internet exposure after accepted migrations; implementing internal segmentation; and containing legacy or end-of-life systems with appropriate compensating controls. The lead coordinates discovery, schedules and production cutovers, testing, issue resolution, change management, and operational handoff. Deliverables include application inventories, production-ready configurations and controls, MOPs, test and rollback evidence, diagrams, runbooks, risk and exception records, support ownership, knowledge transfer, and weekly program reporting.

Requirements

At least 8 years of hands-on security engineering, network security engineering, infrastructure security, or closely related enterprise implementation experience.
Production implementation experience with Zscaler Private Access, including App Connectors, application segments, server groups, access policy, identity integration, logging, high availability, and troubleshooting.
Experience implementing or supporting Zscaler Browser Access or equivalent clientless/private-application access patterns.
Experience implementing segmentation or compensating controls for legacy and end-of-life operating systems, including jump-host and privileged-access dependencies.
Experience leading application-owner discovery, documenting required flows, challenging broad-access requests, and gaining production acceptance.
Experience supporting formal change management, production change windows, test execution, rollback, troubleshooting, and post-change validation.
Ability to independently produce clear technical documentation, implementation artifacts, operational runbooks, diagrams, risk records, and executive-ready status updates.

Nice To Haves

Experience in a large, global, multi-region enterprise environment.
Experience supporting retail stores, distribution centers, manufacturing sites, or other operationally sensitive locations.
Experience with Zero Trust transformation, internet-facing application reduction, VPN modernization, or firewall decommissioning programs.

Responsibilities

Execute technical work supporting the enterprise Zero Trust roadmap and approved target-state patterns.
Translate approved designs into production configurations, implementation plans, test plans, rollback procedures, and operational runbooks.
Implement least-privilege, identity-aware, application-specific access controls using approved enterprise platforms.
Validate production readiness, high availability, monitoring, logging, support ownership, and recovery procedures.
Inventory and validate externally exposed or broadly reachable applications and confirm business and technical ownership.
Configure ZPA application segments, server groups, access policies, identity dependencies, posture requirements, and related infrastructure.
Migrate eligible internal or external applications to ZPA or Browser Access and support testing, cutover, troubleshooting, and production validation.
Coordinate removal of direct internet exposure to migrated applications after acceptance criteria are met.
Support approved isolated-browser or clientless access patterns.
Implement internal segmentation of high-priority services using ZPA and test and troubleshoot changes while maintaining operational continuity and documented rollback capability.
Create migration playbooks for performed activities.
Identify reachable legacy and end-of-life systems requiring compensating controls.
Implement containment zones, restricted communication paths, approved administrative access, jump-host or privileged-access dependencies, and enhanced monitoring.
Validate business, application, backup, monitoring, service-account, and recovery dependencies before enforcing controls.
Document exceptions, residual risk, control evidence, expiration dates, and remediation or retirement ownership.
Lead implementation coordination with application owners, infrastructure engineering, network engineering, identity, endpoint, security operations, site operations, vendors, and change management.
Facilitate technical discovery to document application dependencies, communication flows, authentication requirements, testing responsibilities, and acceptance criteria.
Drive implementation schedules, task ownership, testing windows, production cutovers, issue resolution, and operational handoff.
Maintain blocker and dependency logs, escalate decision points with evidence, and align stakeholders on outcomes and timing.
Coordinate global and site-specific changes while respecting business operating windows, change freezes, and local support requirements.
Produce accurate diagrams, test evidence, rollback procedures, runbooks, and support documentation.
Provide weekly status reporting on production outcomes, risk reduction, blockers, exceptions, and upcoming changes.
Provide knowledge transfer and paired implementation with designated internal engineers before engagement completion.
Deliver prioritized application inventories, owner validation, completed ZPA or Browser Access migrations, production acceptance evidence, and removal or formal exception of direct exposure.
Remediate selected high-risk ZPA configuration issues, including wildcard segments, broad subnets, over-permissive ports, connector resilience, server discovery, logging, and access-policy gaps.
Implement production-ready segmentation patterns across prioritized office, retail, data center, or distribution center environments.
Place priority legacy assets behind enforceable boundary controls with approved administrative paths, monitoring, exceptions, and accountable remediation owners.
Produce operational-readiness artifacts, including MOPs, test and rollback evidence, diagrams, rule matrices, runbooks, configuration records, named support ownership, and knowledge transfer.
Track milestones, blockers, dependencies, risks, exceptions, and measurable implementation outcomes.

Benefits

Medical insurance
Dental insurance
Vision insurance
Critical illness, accident, and hospital coverage
401(k) retirement plan with pre-tax and Roth post-tax contributions
Voluntary life and AD&D insurance for the employee and dependents
Short- and long-term disability coverage
Health Spending Account (HSA)
Transportation benefits
Employee Assistance Program
Time off or leave, including PTO, vacation, or sick leave, subject to eligibility and plan terms