Senior Network Engineer – Zscaler Specialist

Peraton is seeking an experienced Senior Network Engineer specializing in Zscaler cloud security platforms to support network infrastructure and security operations. This individual will serve as a subject matter expert (SME) in Zscaler technologies, leading the design, deployment, migration, and optimization of Zero Trust and Secure Access Service Edge (SASE) architectures. The Senior Network Engineer will collaborate with network, security, and cloud teams to modernize legacy security infrastructure and implement scalable, cloud based solutions that protect users, applications, and data across distributed environments.

The ideal candidate will bring extensive hands on experience with Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA), strong networking fundamentals, and demonstrated expertise in network security engineering, policy management, and enterprise security architecture.

This position requires full time, on site presence at one of the designated locations in Ashburn, VA; Springfield, VA; or Orlando, FL.

Day to Day Roles and Responsibilities:

• Architect, deploy, and manage the full Zscaler product portfolio:
• Zscaler Internet Access (ZIA) — web security, SSL inspection, CASB, DLP, sandboxing, URL filtering
• Zscaler Private Access (ZPA) — Zero Trust Network Access (ZTNA) for internal application connectivity
• Zscaler Digital Experience (ZDX) — end-user experience monitoring and troubleshooting
• Zscaler Posture Control / CNAPP — cloud-native application protection
• Lead migration projects from legacy VPN, on-premises proxies, and traditional perimeter firewalls to Zscaler SASE architecture
• Design and enforce ZIA security policies: threat prevention, SSL/TLS inspection, DNS security, cloud firewall, bandwidth controls, and data loss prevention (DLP)
• Configure and manage ZPA application segments, server groups, App Connectors, and access policies for Zero Trust application access
• Integrate Zscaler with identity providers (IdP): Azure AD/Entra ID, Okta, Ping Identity, and SAML/SCIM provisioning
• Deploy and manage Zscaler Client Connector (Z-App) across Windows, macOS, iOS, and Android endpoints
• Configure Zscaler forwarding methods: GRE/IPsec tunnels, PAC files, proxy chaining, and SD-WAN integrations
• Integrate Zscaler with SD-WAN platforms (Cisco Viptela, VMware VeloCloud, Fortinet) for automated traffic steering
• Monitor platform health, user experience metrics, and security events through the Zscaler Admin Portal and ZDX
• Perform log analysis and threat hunting using Zscaler NSS (Nanolog Streaming Service) integrated with SIEM platforms (Splunk, Microsoft Sentinel, QRadar)
• Lead policy audits and optimization to reduce attack surface, improve performance, and ensure compliance
• Collaborate with application owners to onboard workloads into ZPA and define least-privilege access policies
• Participate in an on-call rotation to support critical Zscaler infrastructure and user connectivity incidents
• Mentor junior engineers on Zero Trust principles, SASE architecture, and Zscaler platform operations
• Maintain comprehensive documentation: architecture diagrams, policy runbooks, onboarding guides, and change records

Basic Qualifications:

• Bachelor's degree and 8 years of experience, a master's degree and 6 years of experience, an associate's degree and 10 years of experience, or a high school diploma or equivalent and 12 years of experience.

• Must be a U.S. Citizen and eligible to obtain the required DHS CBP clearance.

• Minimum of 5 years of hands on network engineering or network security engineering experience, including at least 2 years of dedicated Zscaler platform administration and architecture experience.

• Demonstrated hands on experience administering, configuring, and troubleshooting Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA), including security policies, application segments, App Connectors, and access controls.

• Strong understanding of Zero Trust Network Access (ZTNA), Secure Access Service Edge (SASE), SSL/TLS inspection, certificate management, and enterprise security policy enforcement.

• Strong networking fundamentals, including TCP/IP, DNS, HTTP/S, BGP, routing, firewall policies, and Zscaler traffic forwarding methods such as GRE/IPsec tunnels and PAC files.

• Working knowledge of identity federation and provisioning technologies, including SAML 2.0, SCIM, Microsoft Entra ID, and Okta.

• Strong analytical, troubleshooting, documentation, and communication skills, with the ability to resolve complex connectivity and security issues and collaborate across network, security, and cloud teams.

Preferred Qualifications:

• Experience supporting federal government, defense, or other regulated environments.

• An active DHS Public Trust or Top Secret security clearance or higher is preferred.

• Cisco Certified Network Professional (CCNP) certification. CCNP Enterprise or CCNP Security is acceptable.

• Zscaler Certified Professional (ZCP) certification in ZIA and/or ZPA. Zscaler Certified Engineer (ZCE) or Zscaler Certified Architect (ZCA) certification is also desirable.

• Experience with Zscaler Digital Experience (ZDX), Zscaler Posture Control, or Cloud Native Application Protection Platform (CNAPP) capabilities.

• Experience integrating Zscaler with SIEM platforms such as Splunk, Microsoft Sentinel, or IBM QRadar, and SD WAN platforms such as Cisco, VMware VeloCloud, or Fortinet.

• Experience deploying Zscaler solutions across AWS, Microsoft Azure, or Google Cloud Platform environments.

• Knowledge of security and compliance frameworks, including NIST SP 800 53, FedRAMP, PCI DSS, HIPAA, or DoD Security Technical Implementation Guides (STIGs).

• Experience with scripting and automation using Python, Ansible, Terraform, or Zscaler APIs. Additional certifications such as Palo Alto PCNSE, CCIE Security, CompTIA Security+, AWS or Azure Security Specialty, or CCSP are desirable.