Zero Trust Network Access Architect/Engineer

ASRC Federal•Quantico, VA

1d•$170,000 - $219,695•Hybrid

About The Position

ASRC Federal is hiring a senior Zero Trust Network Architect / Principal Engineer to support its Defense Counterintelligence Security Agency (DCSA) program in Quantico, Virginia. The role serves as the principal technical authority for designing, implementing, and governing enterprise security boundaries, and leads strategic modernization of DCSA’s hybrid workforce infrastructure using Palo Alto Networks platforms, including Panorama and GlobalProtect, and Versa Networks SASE. The position is primarily telework, with onsite work at Quantico Marine Corps Base at least two days per week or as needed. Additional onsite attendance may be required during onboarding and program integration. The successful candidate will lead DCSA’s Zero Trust technical roadmap and architecture, implement and optimize Zero Trust and SASE solutions across cloud, on-premises, and mobile environments, and govern security policies and configurations. The role works with identity and access management teams and integrates network security platforms with SOC tools. It also provides technical leadership and mentorship, produces architecture and security documentation, evaluates vendor capabilities, and advances security automation initiatives.

Requirements

At least 10 years of progressive experience in network security engineering, enterprise architecture, and infrastructure security.
At least 3–4 years of direct experience architecting and implementing Zero Trust frameworks, including NIST SP 800-207, and SASE solutions in enterprise or federal environments.
Advanced architecture-level knowledge of Palo Alto Networks enterprise solutions, including Panorama management and GlobalProtect deployments.
Deep technical proficiency designing and deploying Versa Networks SASE, including SD-WAN, Secure Web Gateway, Cloud Access Security Broker, and Firewall-as-a-Service.
Active Secret clearance, with eligibility for upgrade to TS/SCI.
Must meet 8140 certification requirements; examples include CISM, CISSP-ISSAP, CISSP-ISSEP, GCIA, GDSA, or GICSP.
Bachelor’s degree in Cybersecurity, Computer Engineering, Information Systems Management, or a related field. A master’s degree or an equivalent combination of military service and 12+ years of highly relevant experience is accepted.
Must be able to communicate complex technical ideas verbally and in writing to a diverse customer base.
For alternate worksites other than DCSA facilities or corporate office space, must have reliable voice communication (cell phone preferred) and a stable, capable internet connection.

Nice To Haves

Palo Alto Networks Certified Network Security Engineer (PCNSE).
Palo Alto Networks Certified Zero Trust Network Security Engineer (PCZTNSE).
Versa Certified SASE Professional (VCSP) or Versa Certified SASE Specialist (VCSS).

Responsibilities

Serve as Principal Architect for DCSA’s Zero Trust journey, establishing the technical roadmap, reference architectures, and engineering guidelines aligned with NIST SP 800-207.
Lead end-to-end design, implementation, and optimization of Palo Alto GlobalProtect and Versa Networks SASE for cloud, hybrid on-premises, and mobile endpoints.
Define and govern global security policy templates in Palo Alto Panorama to enforce micro-segmentation, application-level security, and threat prevention.
Architect data loss prevention, SSL/TLS decryption, and threat prevention strategies across egress and ingress points.
Review SASE and ZTNA configurations to identify performance bottlenecks, configuration drift, and security gaps, and develop mitigation strategies.
Collaborate with IAM teams to integrate ZTNA/SASE policies with identity providers such as Okta and Azure AD, evaluating device posture, user context, and continuous authentication in real time.
Guide integration of Versa SASE and Palo Alto platforms with SOC environments, including SIEM, SOAR, and EDR/XDR tools.
Provide technical leadership and guidance to the cybersecurity engineering team and serve as the tier-4 escalation point for complex architecture, routing, and access-control challenges.
Author high-level designs, low-level designs, system security plans, and change-management policies for executive and government stakeholders.
Monitor Palo Alto PAN-OS and Versa Networks capabilities and conduct proofs of concept to evaluate and deploy new capabilities.
Champion security-as-code and automation initiatives using APIs and orchestration tools to automate secure connectivity and zero-touch deployments.