Senior Network Engineer – Zscaler SME

Description

The company needs a senior network engineer with deep Zscaler skills to support HRSA. You will own the design, operation, and security of the agency's Zscaler environment and help with the wider enterprise LAN/WAN, firewall, and remote-access setup.

This is a hands-on role working with project managers, the Office of Information Security and Privacy (OISP), and desktop and server support teams.

Responsibilities

• Run, upgrade, and tune ZIA, ZPA, and ZDX, including major and minor releases, reporting, and security blocks.
• Build and maintain ZIA policies for SSL inspection, URL filtering, DLP, CASB, app control, and advanced threat protection, working with OISP.
• Keep the SSO link between Zscaler and Okta running, including SAML attributes and SCIM provisioning.
• Run Zscaler best practice assessments and security lifecycle reviews, and change rulesets as security and networking needs shift.
• Write troubleshooting playbooks for Zscaler Client Connector issues and help endpoint and server teams use them.
• Design, build, and maintain enterprise LAN/WAN, routing and switching, firewalls, and remote access over IPv4 and IPv6.
• Support RSA SecurID Authentication Manager and its integration with VPN, RADIUS, and LDAP.
• Monitor network performance, lead upgrades and technology refreshes, and arrange hardware and software purchases when needed.
• Produce ad hoc Zscaler reports for leadership and keep network documentation, diagrams, and SOPs current.

Requirements

• Bachelor's degree or an equivalent mix of education and experience.
• 8+ years in network engineering, including 5+ years of hands-on Zscaler administration (ZIA, ZPA, ZDX).
• Solid SASE architecture knowledge and proven Zscaler policy skills across SSL inspection, URL filtering, DLP, CASB, and threat protection.
• Experience connecting Okta or another IdP to Zscaler using SAML and SCIM.
• Strong grasp of TCP/IP, DNS, routing and switching, IPsec VPN, and firewalls, plus end-to-end troubleshooting with PCAP analysis in Wireshark.
• Hands-on Cisco switching and IOS upgrade experience, and at least one enterprise firewall platform (Cisco ASA/Firepower or Palo Alto/Panorama).
• Work in federal or enterprise settings with strict compliance and 99.9%+ uptime targets, with familiarity with NIST 800-53, TIC 3.0, and CISA BODs.
• Formal change management experience and TLS certificate lifecycle management.
• Clear communication, documentation, and teamwork skills.
• Preferred: Zscaler Certified Cloud Professional (ZCCP) or Zscaler Certified Cloud Administrator (ZCCA).
• Preferred: Okta Certified Professional or higher.
• Preferred: experience with Cisco ISE, RSA SecurID, SolarWinds scripting, Azure networking (NSGs), Riverbed, Grafana, or Cribl.

Conditions

You must be able to obtain a Public Trust, with an NACI (T1) investigation required.

You must have lived in the U.S. for 3 of the last 5 years and pass a public trust background investigation.

U.S. citizenship is not required.

The role is onsite in Rockville, MD, with no telecommuting.

Scheduled hours are 40 per week, and no travel is required.

The likely salary range is $111,350 to $150,650. This is not a guarantee. Pay depends on experience, location, and possibly contract terms, and may fall outside this range.

Identity verification uses biometrics and AI, and interviews are on camera. By continuing, you authorize collection and use of your biometric data for verification and security.

Equal opportunity employer, including individuals with disabilities and protected veterans.

Benefits

• Medical plans, some with Health Savings Accounts, plus dental and vision plans.
• 401(k) with company match, with pre-tax and post-tax contributions up to IRS annual limits.
• Full flex work weeks where possible.
• Paid time off for vacation, sick and personal time, holidays, paid parental, military, bereavement, and jury duty leave.
• Short- and long-term disability, life, accidental death and dismemberment, personal accident, critical illness, and business travel and accident insurance, provided or available.
• Paid education and certifications, internal mobility support, and access to cutting-edge technology.