SENIOR NETWORK SECURITY ENGINEER-(REMOTE)

Job Summary

The Network Services team is responsible for building, supporting, and optimizing the Compass North American network in all on-premises and cloud environments.  The Network Services team works hand in hand with all technology teams within the Enterprise Architecture and Shared Services Technology (EASST) division to support the goals of Compass Technology and Compass Group.

The Sr. Network Security Engineer is responsible for the design, deployment, and support of the organization’s secure network access and zero trust architecture across cloud and on-premises environments. This individual should be familiar with and leverage industry best practices when designing, deploying, configuring, and maintaining secure access solutions that protect users, applications, and data.

The Sr. Network Security Engineer is a technical leader within the Network Services team and is charged to understand the goals/objectives of that team and how it supports those of the Enterprise Architecture and Shared Services Technology division.

This role leads the design, deployment, and operations of the organization’s zero trust architecture, with primary ownership of the Zscaler suite (ZIA, ZPA, and ZTNA) across on-premises and AWS cloud environments. The Sr. Network Security Engineer partners with Cyber Security and Cloud teams to expand the ZPA footprint and advance zero trust access for private applications. An initial focus is a proof of concept evaluating Zscaler’s Zero Trust Exchange as a path to modernize private application connectivity in AWS.

Job Responsibilities

• Provide inter-team / inter-technology research, collaboration, design, troubleshooting, and response supporting Compass on-prem and cloud environments
• Lead platform optimization and long-term issue resolution efforts
• Perform backup and restore testing/validation weekly/monthly/quarterly
• Provide tier 3 support for incidents related to any technology owned and supported by the Network Services group 
• Serve as subject matter expert for the Zscaler Zero Trust Exchange — ZIA, ZPA, Zscaler Client Connector (ZCC), and ZDX — including tenant configuration, policy design, and lifecycle management
• Deploy, validate, and maintain ZPA App Connectors across AWS, on-premises, and branch environments to broker least-privilege, per-application access
• Design and fine-tune granular access policies, including application segmentation, URL filtering, SSL/TLS inspection, cloud firewall, sandboxing, and data loss prevention (DLP)
• Configure and maintain forwarding profiles, SSL inspection, and secure web gateway controls, tuning for security posture and user experience
• Lead a proof of concept evaluating Zscaler’s Zero Trust Exchange for private application access in AWS, and, based on results, help define the roadmap for modernizing connectivity
• Monitor tenant health, security events, and digital experience using ZDX; troubleshoot client connectivity, authentication, and policy-enforcement issues using logs, packet captures, and HAR files
• Integrate Zscaler with identity providers (Microsoft Entra ID) using SAML and OIDC for SSO, MFA, and conditional access, and support Zscaler Client Connector (ZCC) deployment via endpoint management tools such as Intune
• Participate in incident, problem, and change management within CAB-controlled processes, and author runbooks, standard operating procedures, and network diagrams

Experience, Skills & Qualications

• 5+ years of experience in network security, cybersecurity engineering, or network engineering with a strong security emphasis
• Hands-on experience administering Zscaler ZIA and ZPA at scale, including policy creation, Client Connector deployment, and App Connector hosting
• Practical understanding of Zero Trust Network Access (ZTNA) principles and least-privilege, per-application access models
• Working knowledge of AWS cloud networking (VPCs, route tables, security groups, Transit Gateway, and PrivateLink)
• Strong familiarity with identity and SSO technologies (SAML 2.0, OIDC, Microsoft Entra ID, MFA, and conditional access)
• Solid foundation in core networking: TCP/IP, DNS, DHCP, routing, and SSL/TLS certificates
• Comfortable reading logs, packet captures, and HAR files to isolate and resolve faults 
• Highly knowledgeable of security concepts and protocols such as IPSec, SSL/TLS, IDS/IPS, WAF and DDoS protection 
• Knowledgeable of cloud and hybrid cloud networks especially AWS networking design principles
• Bachelor’s degree in computer science, or a combination of education and experienceExcellent verbal and written communication skills
• Excellent critical thinking and problem-solving skills
• Positive attitude and solutions-oriented thinking
• Ability to communicate technical concepts to both technical and non-technical audiences

Preferred

• AWS WAF and AWS Firewall Manager experience an asset
• Aviatrix experience an asset
• Scripting and automation with PowerShell, Python, or Terraform (including the Zscaler providers) an asset
• AWS or equivalent cloud certification (AWS-Practitioner) 
• Zscaler certification such as ZIA Certified Administrator, ZPA Professional, Zscaler Digital Transformation Administrator (ZDTA), or Zscaler Digital Experience Administrator (ZDXA)
• AWS Advanced Networking Specialty certification
• Security certification such as CompTIA Security+ or SANS/GIAC
• ITIL v3 Foundation’s desirable