Security Engineer

Role Specification: Security Engineer Zscaler

Programme Context

Programme: Technology Separation (Divestiture)
Workstream: Network Separation — Security
Engagement Type: Contract (via supplier)
Reports to: Engineering Lead / Programme Leads
Location: Remote / Hybrid (as agreed)

---

Purpose of the Role

We are seeking an experienced Zscaler Security Engineer to deliver tenant separation, policy build-out, and operational readiness activities for the Zscaler platform (ZIA and ZPA) as part of a large-scale corporate divestiture programme. The role is responsible for building a new Zscaler tenant for the retained entity, migrating policies and configurations, establishing cross-tenant transitional access, and ensuring bidirectional separacy between entities ahead of Day 1.

The successful candidate will have deep hands-on experience with Zscaler ZIA and ZPA administration, policy design, and ideally Infrastructure as Code (Terraform) for Zscaler configuration management. They will work closely with Zscaler Professional Services, the identity team, the workplace team, and the core routing workstream (for GRE tunnel integration).

---

Key Responsibilities

Tenant Separation & Build-Out
• Build and configure a new Zscaler tenant (ZIA and ZPA) as a full net-new deployment for the retained entity
• Configure ZIA internet security policies (URL filtering, threat protection, DLP, SSL inspection, cloud firewall)
• Configure ZPA access policies, forwarding policies, inspection policies, and isolation policies
• Deploy ZPA App Connectors in retained-entity network segments and validate connectivity
• Establish GRE tunnels from PoP internet routers to the new ZIA cloud instance
• Configure Zscaler Digital Experience (ZDX) monitoring

Identity Integration
• Configure SAML/OIDC federation between the new Zscaler tenant and the shared identity provider (e.g. Okta)
• Implement attribute-based user routing to ensure users are directed to the correct tenant
• Coordinate with the identity team on group/attribute configuration for entity classification
• Validate that users without valid entity classification are denied access to both tenants

Separacy Enforcement
• Implement and validate bidirectional separacy controls — ensuring neither entity's users can access the other's private applications without explicit authorisation
• Configure automated policy audit mechanisms to detect and alert on separacy violations
• Support Day 1 readiness testing including cross-tenant access validation

Transitional Cross-Tenant Access
• Configure Multi-ZPA Tenant Access for explicitly agreed shared services during the transitional period
• Maintain cross-tenant access policies aligned to the transitional services schedule
• Conduct periodic access reviews and revoke access for services that have completed transition

Divested Tenant Cleanup
• Remove retained-entity users, policies, application segments, and App Connectors from the divested tenant
• Reconfigure RBAC and administrative access on the divested tenant for the divested entity's operations team
• Support devolved policy management models for divested teams using IaC/CICD

Transitional Service Operations & Exit
• Provide administration of the divested tenant during the transitional period (platform management, connector management, tunnel management)
• Produce periodic service reports covering availability and incident metrics
• Support handover including admin transfer, IdP migration, and cross-tenant policy removal

Reporting & Analytics
• Configure independent cyber reporting (e.g. Zscaler 360i) for each tenant
• Ensure no cross-entity data leakage in reporting and analytics dashboards

Collaboration & Delivery
• Work with Zscaler Professional Services on tenant provisioning and configuration
• Coordinate with the core routing team on GRE tunnel and internet edge integration
• Collaborate with the workplace team on Client Connector deployment and MDM integration
• Participate in design assurance reviews and produce technical documentation

---

Required Skills & Experience

Zscaler Platform
• Deep hands-on experience administering Zscaler ZIA (URL filtering, threat protection, DLP, SSL inspection, cloud firewall rules)
• Deep hands-on experience administering Zscaler ZPA (access policies, App Connectors, application segments, segment groups, server groups)
• Experience with Zscaler Client Connector deployment and configuration
• Understanding of Zscaler GRE/IPSec tunnel integration for non-Client Connector traffic
• Familiarity with Zscaler Digital Experience (ZDX) monitoring
• Experience with multi-tenant or divestiture scenarios in Zscaler

Identity & Access
• Strong understanding of SAML/OIDC federation and identity provider integration
• Experience with Okta or equivalent enterprise identity provider
• Understanding of attribute-based access control and user routing
• Familiarity with SCIM provisioning for user/group synchronisation

Infrastructure as Code
• Experience managing Zscaler configuration via Terraform (Zscaler Terraform provider)
• Familiarity with CICD pipelines for policy deployment (GitHub Actions or equivalent)
• Understanding of GitOps practices for configuration management

Security & Policy Design
• Strong understanding of zero trust network access (ZTNA) principles
• Experience designing internet security policies (web filtering, threat prevention, DLP)
• Understanding of SSL inspection, certificate management, and bypass policies
• Familiarity with cloud firewall rule design and traffic forwarding policies

VPN & Legacy Remote Access
• Understanding of traditional VPN technologies (Cisco ASA, AnyConnect) and how they relate to/migrate towards ZTNA
• Experience with VPN separation or decommissioning as part of Zscaler adoption programmes
• Familiarity with split-tunnel vs full-tunnel architectures and coexistence with Zscaler Client Connector

Identity & Access Control
• Familiarity with Cisco ISE or equivalent NAC platforms — understanding of how Zscaler integrates with broader identity and access control ecosystems
• Understanding of TACACS+/RADIUS in the context of network device authentication alongside ZTNA

Cloud Security Integration
• Understanding of cloud security architecture in AWS, Azure, and/or GCP (VPC security groups, NSGs, cloud firewalls)
• Familiarity with deploying Zscaler App Connectors and Private Service Edges in cloud environments
• Experience with securing hybrid connectivity (Direct Connect, ExpressRoute, GRE/IPSec tunnels) through Zscaler

Automation, DevOps & Tooling
• Daily use of Git and GitHub (branching, pull requests, code review workflows)
• Working knowledge of Python — able to read, run, and contribute to automation codebases (e.g. Zscaler SDK scripts, policy validation)
• Experience with Terraform for Zscaler configuration management (Zscaler Terraform provider — consuming and contributing to modules)
• Ability to consume and operate CI/CD-driven policy deployment pipelines built by the automation team
• Comfortable working with structured data formats (JSON, YAML, HCL) used in automation templates

General
• Understanding of network fundamentals (routing, DNS, IP addressing) sufficient to configure tunnel integrations
• Experience with change management and controlled policy rollout
• Ability to produce clear technical documentation and runbooks

---

Desirable Skills

• Zscaler Certified Cloud Professional (ZCCP) or equivalent certification
  • Experience with Zscaler 360i reporting and cyber posture dashboards
  • Familiarity with CrowdStrike, Microsoft Defender, or similar endpoint integration with Zscaler
  • Experience with network separation or divestiture programmes
  • Understanding of transitional service agreement governance and service management frameworks
  • Experience with Pydantic or similar for policy-as-code validation
  • CCNP Security or equivalent certification
  

---

Working Practices

• Agile delivery within two-week sprints
  • All code and configuration submitted via pull request with peer review where applicable
  • Infrastructure and automation code maintained in GitHub repositories
  • Design decisions documented and aligned to the programme's design assurance framework
  • Collaboration via Slack, Google Meet, and Jira
  

Documentation & Design
• Produce low-level designs (LLDs), technical working papers, and decision records as part of day-to-day delivery
• Documentation authored and maintained in Confluence and Google Drive
• Diagramming in Miro and Draw.io, following C4 modelling conventions where appropriate

AI & Productivity Tooling
• Expected to leverage AI-assisted tools including Gemini, NotebookLM, GitHub Copilot, and Kiro to accelerate delivery and improve quality