Security Engineer – Zscaler (NetDevOps / SecDevOps)

Role Type: Contract – Initial 6 Months, with potential extension to July 2027

Programme: Technology Separation / Corporate Divestiture

Workstream: Network Separation – Security

Location: Remote

Position Overview

We are looking for an experienced Zscaler Security Engineer with strong Project Delivery and Terraform experience to support a major Technology Separation / Corporate Divestiture programme.

This is a project implementation and delivery-focused role, not a BAU/operations support position .

The successful candidate must have hands-on experience delivering Zscaler implementation, migration, transformation, or separation projects , ideally involving ZIA, ZPA, Terraform, Git/GitHub and security automation .

The role will involve designing and deploying a new Zscaler environment , migrating security policies and configurations, implementing identity integrations, establishing transitional access between environments, and ensuring complete security separation before Day 1.

Key Responsibilities

• Deliver Zscaler implementation and transformation projects from design through deployment and handover.
• Build and configure a new Zscaler tenant from scratch , covering ZIA and ZPA.
• Design and implement ZIA security policies including:
• Cloud Firewall
• URL Filtering
• SSL Inspection
• Data Loss Prevention (DLP)
• Advanced Threat Protection
• Design and implement ZPA environments including:
• Application Segments
• Segment Groups / Server Groups
• Access Policies
• ZPA App Connectors
• Zero Trust / ZTNA controls
• Deliver Zscaler configurations through Infrastructure-as-Code / Policy-as-Code using Terraform .
• Develop and maintain Terraform HCL configurations using the Zscaler Terraform Provider .
• Integrate Terraform deployments with Git/GitHub and CI/CD pipelines .
• Support security policy testing, peer reviews, controlled releases and production deployments.
• Configure identity federation using SAML/OIDC, SCIM and enterprise identity providers such as Okta .
• Implement attribute-based access controls and user routing.
• Support Zscaler tenant migrations and corporate separation/divestiture activities .
• Configure Multi-ZPA Tenant Access where temporary shared access is required during transition.
• Remove legacy configurations and implement strict access separation between entities.
• Configure and validate GRE/IPSec tunnels between network infrastructure and the Zscaler cloud.
• Work closely with Network, Security, Cloud, IAM and Infrastructure teams throughout project delivery.
• Produce implementation documentation, configuration standards, migration plans, testing evidence and handover documentation.

Mandatory Skills & Experience

Zscaler Project Delivery

• Strong hands-on experience delivering Zscaler projects , rather than solely supporting existing operational environments.
• Experience with at least one of the following:
• New Zscaler implementations
• Zscaler migrations
• Tenant builds
• Security transformation programmes
• Corporate separation/divestiture projects
• Large-scale ZIA/ZPA deployments

Zscaler Internet Access – ZIA

• Strong hands-on experience designing and implementing ZIA .
• Experience with:
• Cloud Firewall
• URL Filtering
• SSL Inspection
• DLP
• Advanced Threat Protection

Zscaler Private Access – ZPA

• Strong hands-on experience implementing ZPA / ZTNA .
• Experience configuring:
• Application Segments
• Segment/Server Groups
• Access Policies
• ZPA App Connectors
• Private application access

Terraform – Mandatory

• Strong hands-on Terraform experience within Zscaler project delivery.
• Experience using the official Zscaler Terraform Provider .
• Ability to write and maintain Terraform/HCL code for security configuration.
• Experience managing Zscaler policies and configurations programmatically.
• Experience integrating Terraform with Git/GitHub and CI/CD pipelines .

Git / DevOps / Automation

• Hands-on experience with:
• Git
• GitHub
• Branching and Pull Requests
• Code reviews
• CI/CD pipelines
• Infrastructure-as-Code / Policy-as-Code

Identity & Security Integration

• Experience integrating Zscaler with enterprise identity platforms.
• SAML / OIDC authentication.
• SCIM provisioning.
• Okta or similar enterprise IdP experience.
• Attribute-Based Access Control (ABAC).

Network Integration

• Good understanding of:
• Routing
• DNS
• Subnets
• IP addressing
• GRE tunnels
• IPSec tunnels

Highly Desirable

• Previous experience working on corporate divestiture, M&A, network separation or tenant migration projects .
• Experience with Multi-ZPA Tenant Access .
• Zscaler Digital Experience ( ZDX ) experience.
• Zscaler 360i reporting.
• Integration with endpoint security solutions such as CrowdStrike or Microsoft Defender.
• Zscaler certifications such as:
• Zscaler Certified Cloud Professional (ZCCP)
• Zscaler Certified Cloud Expert (ZCCE)

Critical Candidate Profile

We are specifically looking for candidates who can demonstrate:

Zscaler ZIA/ZPA + Terraform + Project Delivery / Implementation experience.

Priority Profile

Zscaler Project Engineer / Security Engineer with hands-on ZIA & ZPA implementation, Terraform automation, Git/CI-CD and migration or transformation project delivery experience.