Zscaler Solutions Architect SME

Serve as a Zscaler Solutions Architect SME enabling the Department of Homeland Security (DHS) mission and enterprise network infrastructure. The applicant will serve as the primary technical authority for designing, deploying, administering, upgrading and optimizing enterprise-wide Secure Access Service Edge (SASE) solutions using the Zscaler cloud security platform. This role leads the operational architecture across Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), and Zscaler Digital Experience (ZDX), driving modern Zero Trust initiatives.

Responsibilities

Design, implement, and maintain enterprise Zscaler deployments (ZIA, ZPA, ZDX, and Zscaler Client Connector) across multi-cloud and hybrid corporate environments; Create, audit, and tune security policies, including URL filtering, Cloud Application Control, SSL/TLS deep packet inspection, Data Loss Prevention (DLP), and sandbox policies; Formulate and execute ZPA access policies for least-privilege direct access to internal applications in AWS, Azure, GCP, and on-premises data centers; Serve as Tier-3/Tier-4 escalation support for complex proxy routing, PAC file debugging, identity integration, authentication drops, and application latency issues; Manage enterprise distribution, health checks, profile tuning, and version upgrades of Zscaler Client Connector across macOS, Windows, iOS, and Android; Leverage ZDX and cloud analytics to isolate user experience degradation; configure automated alerting and SIEM log integration (Splunk, Cribl); Partner with IAM teams to configure SAML/SCIM attributes with IdPs such as Okta, Microsoft Entra ID, or Ping Identity; Provide Tier 2/Tier 3 escalation support for network outages, circuit degradations, and performance issues; conduct root cause analyses and coordinate vendor support; Maintain network diagrams (Visio), topology maps, inventory databases, SOPs, and change control tickets (ServiceNow/Remedy); Support 24/7/365 on-call rotation readiness for Tier 3 critical network incidents and cross-functional escalation; Implement Emergency Change Requests, Emergency Break Fixes, or Change Requests when needed to restore services; Participate in RCA and post-incident analysis for mission critical and mission essential applications and infrastructure; Partner with program and project managers to align network engineering deliverables and milestones; Travel within the United States on short notice or scheduled, up to 20% of the time

Requirements

Minimum of 10+ years of relevant experience; Hands-on experience with Zscaler Internet Access (ZIA): security policies, URL filtering, SSL inspection, traffic forwarding, authentication, and advanced troubleshooting; Hands-on experience with Zscaler Private Access (ZPA): App Connectors, application segments, access policies, private application connectivity, and troubleshooting; Hands-on experience with Zscaler Client Connector (ZCC): deployment, configuration, forwarding profiles, upgrades, endpoint compatibility, and troubleshooting; Hands-on experience with Zscaler Digital Experience (ZDX): application performance monitoring, network path analysis, latency investigation, and troubleshooting; Advanced knowledge of JavaScript-based PAC files, proxy configurations, routing logic, and application-specific bypass requirements; PowerShell scripting and automation for troubleshooting and operational support; Strong knowledge of TCP/IP, DNS, routing, firewalls, VPNs, TLS/SSL, proxy architecture, and network traffic analysis; Ability to independently diagnose complex connectivity, authentication, application performance, and security policy issues; Certifications: Zscaler ZIA administration certification or equivalent official training, Zscaler ZPA administration certification or equivalent official training, Zscaler ZDX training or relevant certification where available, Cisco CCNA or CCNP, CompTIA Security+, relevant Zscaler Zero Trust or advanced security training; Must be able to pass a CBP BI

Nice to have

Experience with Splunk, Cribl, CrowdStrike, and Okta; Familiarity with AWS and Microsoft Azure; Developer tools: GitHub, Docker, Git, Visual Studio, VS Code, development repositories, APIs; Mobile technologies, mobile device management, wireless connectivity, and VPN interactions; ZSIM-related applications and infrastructure; WCTTV camera systems; Drone technologies and related platforms