ZScaler Network SME

Agile Defense•Ashburn, VA

About The Position

Serve as a Zscaler Network SME supporting the Department of Homeland Security (DHS) mission and enterprise network infrastructure. The role is the primary technical authority for designing, deploying, administering, upgrading, and optimizing enterprise-wide Secure Access Service Edge (SASE) solutions using the Zscaler cloud security platform. It leads operational architecture across Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), and Zscaler Digital Experience (ZDX), advancing Zero Trust initiatives. The SME provides architecture and engineering, policy governance, Zero Trust deployment, advanced troubleshooting, client-agent lifecycle management, observability and analytics, cross-functional integration, incident management, documentation, on-call support, root cause analysis, and project support. The position supports a 24/7/365 on-call rotation for critical network incidents and may implement emergency or standard changes to restore service. Travel within the United States may be required, on short notice or as scheduled, up to 20% of the time. The role requires at least five years of relevant experience, strong hands-on expertise across ZIA, ZPA, ZCC, ZDX, PAC files, and PowerShell, plus enterprise networking and advanced troubleshooting knowledge. The candidate must be able to pass a CBP background investigation. Salary is $170,000–$185,000 per year.

Requirements

At least 5 years of relevant experience.
Hands-on ZIA experience, including security policies, URL filtering, SSL inspection, traffic forwarding, authentication, and advanced troubleshooting.
Hands-on ZPA experience, including App Connectors, application segments, access policies, private application connectivity, and troubleshooting.
Hands-on ZCC experience, including deployment, configuration, forwarding profiles, upgrades, endpoint compatibility, and troubleshooting.
Hands-on ZDX experience, including application performance monitoring, network path analysis, latency investigation, and troubleshooting.
Advanced knowledge of JavaScript-based PAC files, proxy configurations, routing logic, and application-specific bypass requirements.
PowerShell scripting and automation experience for troubleshooting and operational support.
Strong knowledge of TCP/IP, DNS, routing, firewalls, VPNs, TLS/SSL, proxy architecture, and network traffic analysis.
Ability to independently diagnose complex connectivity, authentication, application performance, and security policy issues; coordinate with technical teams; and document root causes and corrective actions.
Ability to pass a CBP background investigation.
Excellent problem-solving and analytical skills for troubleshooting complex network issues.

Nice To Haves

Zscaler ZIA administration certification or equivalent official training.
Zscaler ZPA administration certification or equivalent official training.
Zscaler ZDX training or relevant certification, where available.
Cisco CCNA or CCNP certification.
CompTIA Security+ certification.
Relevant Zscaler Zero Trust or advanced security training.
Experience investigating Zscaler-related connectivity, authentication, performance, and security-policy issues involving Splunk, Cribl, CrowdStrike, and Okta.
Experience with AWS and Microsoft Azure.
Familiarity with GitHub, Docker, Git, Visual Studio, VS Code, development repositories, APIs, and other enterprise development platforms.
Familiarity with mobile devices, mobile applications, wireless connectivity, VPN interactions, and mobile device management solutions.
Experience troubleshooting ZSIM-related applications and infrastructure.
Familiarity with WCTTV camera systems, including network connectivity, remote access, streaming, and security policy compatibility.
Familiarity with drone platforms, management software, connectivity, and application access requirements.

Responsibilities

Design, implement, and maintain enterprise Zscaler deployments, including ZIA, ZPA, ZDX, and Zscaler Client Connector, across multi-cloud and hybrid corporate environments.
Create, audit, and tune security policies for URL filtering, Cloud Application Control, SSL/TLS deep packet inspection, DLP, and sandboxing.
Formulate and execute ZPA access policies that enable least-privilege access to internal applications in private clouds and on-premises data centers without traditional VPN overhead.
Provide Tier 3/Tier 4 escalation support for complex proxy routing, PAC file debugging, identity integration, authentication drops, and application latency issues.
Manage enterprise distribution, health checks, profile tuning, and version upgrades of Zscaler Client Connector across macOS, Windows, iOS, and Android.
Use ZDX and cloud analytics to isolate user-experience degradation across endpoints, network ISPs, and applications; configure automated alerting and SIEM log integration.
Work with IAM teams to configure SAML/SCIM attributes with identity providers such as Okta, Microsoft Entra ID (Azure AD), and Ping Identity.
Provide Tier 2/Tier 3 escalation support for network outages, circuit degradation, and performance issues; conduct root cause analyses and coordinate vendor support.
Maintain network diagrams, topology maps, inventory databases, SOPs, and change-control tickets using tools such as Visio and ServiceNow/Remedy.
Support readiness for a 24/7/365 on-call rotation, respond to critical Tier 3 network incidents within SLA limits, and coordinate cross-functional escalations.
Implement emergency change requests, emergency break fixes, or change requests when needed to restore services.
Participate in root cause and post-incident analyses for mission-critical applications, mission-essential applications and network infrastructure, and recurring enterprise IT issues.
Partner with program and project managers to align network engineering deliverables, milestone schedules, and resource planning with enterprise project objectives.
Travel within the United States, on short notice or as scheduled, up to 20% of the time.