ZScaler Network SME

Agile Defense•Ashburn, VA

2d•$170,000 - $185,000

About The Position

Serve as a ZScaler Network SME supporting the Department of Homeland Security (DHS) mission and enterprise network infrastructure. The role is the primary technical authority for designing, deploying, administering, upgrading, and optimizing enterprise-wide Secure Access Service Edge (SASE) solutions using the Zscaler cloud security platform. It leads operational architecture across Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), and Zscaler Digital Experience (ZDX), advancing Zero Trust initiatives. The SME provides architecture and engineering for Zscaler deployments across multi-cloud and hybrid corporate environments; develops and tunes security policies; implements least-privilege access to private applications; and provides advanced operational troubleshooting and escalation support. The role also manages Zscaler Client Connector deployment and lifecycle, uses ZDX and cloud analytics to investigate user experience issues, integrates identity and SIEM systems, and maintains network documentation and change records. The position supports a 24/7/365 on-call rotation for critical network incidents, participates in incident and root-cause analysis, coordinates vendor and cross-functional support, and partners with program and project managers on engineering deliverables and schedules. Travel within the United States, scheduled or on short notice, may be required up to 20% of the time. The candidate must be able to pass a CBP background investigation.

Requirements

At least 5 years of relevant experience.
Hands-on experience with ZIA security policies, URL filtering, SSL inspection, traffic forwarding, authentication, and advanced troubleshooting.
Hands-on experience with ZPA App Connectors, application segments, access policies, private application connectivity, and troubleshooting.
Hands-on experience deploying, configuring, and troubleshooting Zscaler Client Connector, including forwarding profiles, upgrades, and endpoint compatibility.
Hands-on experience with ZDX application performance monitoring, network path analysis, latency investigation, and troubleshooting.
Advanced knowledge of JavaScript-based PAC files, proxy configurations, routing logic, and application-specific bypass requirements.
PowerShell scripting and automation for troubleshooting and operational support.
Strong knowledge of TCP/IP, DNS, routing, firewalls, VPNs, TLS/SSL, proxy architecture, and network traffic analysis.
Ability to independently diagnose complex connectivity, authentication, application performance, and security policy issues; coordinate with technical teams; and document root causes and corrective actions.
Ability to pass a CBP background investigation.
Ability to travel within the United States up to 20% of the time.
Zscaler ZIA administration certification or equivalent official training.
Zscaler ZPA administration certification or equivalent official training.
Cisco CCNA or CCNP certification.
CompTIA Security+ certification.

Nice To Haves

Zscaler ZDX training or relevant certification, where available.
Relevant Zscaler Zero Trust or advanced security training.
Experience investigating Zscaler-related connectivity, authentication, performance, and security policy issues involving Splunk, Cribl, CrowdStrike, and Okta.
Experience with AWS and Microsoft Azure.
Familiarity with GitHub, Docker, Git, Visual Studio, VS Code, development repositories, APIs, and other enterprise development platforms.
Experience with mobile devices, mobile applications, wireless connectivity, VPN interactions, and mobile device management solutions.
Experience troubleshooting connectivity and security involving ZSIM-related applications and infrastructure.
Experience with WCTTV camera system connectivity, remote access, streaming, and security policy compatibility.
Experience with drone platform connectivity, application access, management software, and supporting services.

Responsibilities

Design, implement, and maintain enterprise Zscaler deployments, including ZIA, ZPA, ZDX, and Zscaler Client Connector, across multi-cloud and hybrid environments.
Create, audit, and tune security policies, including URL filtering, Cloud Application Control, SSL/TLS deep packet inspection, DLP, and sandbox policies.
Formulate and execute ZPA access policies to provide least-privilege access to private-cloud and on-premises applications without traditional VPN overhead.
Provide Tier 3/Tier 4 escalation support for proxy routing, PAC file debugging, identity integration, authentication drops, and application latency issues.
Manage enterprise distribution, health checks, profile tuning, and version upgrades of Zscaler Client Connector on macOS, Windows, iOS, and Android.
Use ZDX and cloud analytics to identify user experience degradation across endpoints, ISPs, and applications; configure automated alerting and SIEM log integration.
Partner with IAM teams to configure SAML/SCIM attributes with identity providers such as Okta, Microsoft Entra ID (Azure AD), and Ping Identity.
Provide Tier 2/Tier 3 escalation support for network outages, circuit degradation, and performance issues; conduct root-cause analyses and coordinate vendor support.
Maintain network diagrams, topology maps, inventory databases, SOPs, and change-control tickets in systems such as ServiceNow or Remedy.
Maintain readiness for a 24/7/365 on-call rotation and respond to critical network incidents within SLA limits; coordinate cross-functional escalation pathways.
Develop and implement emergency change requests, emergency break fixes, or change requests when needed to restore services.
Participate in root-cause and post-incident analyses for mission-critical applications and mission-essential applications and network infrastructure, including recurring infrastructure issues.
Partner with program and project managers to align network engineering deliverables, milestones, and resource planning with project objectives.
Travel within the United States, either scheduled or on short notice, up to 20% of the time.