Zscaler Consultant (Zero Trust Security)

The role

We are hiring a hands-on Zscaler Consultant with 5 to 7 years of network security experience to design, deploy and optimize Zscaler Zero Trust Exchange for enterprise clients. This is a deeply technical role: the consultant builds and troubleshoots the platform directly, not through a team.

The consultant owns Zscaler engagements end to end, from assessment through production cutover and handover.

You will lead discovery workshops, assess the client's current network, proxy, VPN and firewall estate, and design the Zscaler architecture across ZIA, ZPA and ZDX, covering traffic forwarding, the policy model and tenant structure.

You will configure ZIA, including URL filtering, cloud firewall, SSL inspection, DLP, CASB, sandbox and bandwidth control, and deploy ZPA with App Connectors, Private Service Edges, application segments, server groups and access policies. You will roll out Zscaler Client Connector at scale through Intune, SCCM or Jamf, integrate Entra ID, Okta or Ping via SAML and SCIM, and set up GRE and IPsec tunnels, PAC files and Branch Connector.

You will migrate clients from legacy proxies and VPNs such as Blue Coat, McAfee Web Gateway, Forcepoint, AnyConnect, GlobalProtect and Pulse Secure, and troubleshoot connectivity, authentication, SSL inspection and application access down to packet level.

You will stream logs to Splunk, Microsoft Sentinel or QRadar through NSS and Cloud NSS, automate configuration and reporting with the Zscaler API, Python or Terraform, and close each engagement with design documents, runbooks, test plans, as-built records and training for the client's operations team.

Key responsibilities

• Lead the architecture, design, implementation, and delivery of enterprise Zscaler ZIA and ZPA solutions.
• Define Zero Trust security architecture aligned with business, network, cloud, and cybersecurity requirements.
• Design and manage ZIA policies, SSL inspection, URL filtering, Cloud Firewall, DLP, and threat protection controls.
• Architect ZPA solutions including App Connectors, Application Segments, Segment Groups, Server Groups, and access policies.
• Lead migration initiatives from traditional VPN, proxy, and perimeter-based security solutions to Zscaler.
• Manage end-to-end project delivery, including planning, technical execution, testing, deployment, and production transition.
• Troubleshoot complex connectivity, authentication, performance, routing, and policy-related issues across Zscaler environments.
• Integrate Zscaler with identity providers, SIEM platforms, endpoint solutions, firewalls, and cloud environments.
• Provide technical leadership, mentoring, architecture reviews, documentation, and best-practice guidance to engineering teams.
• Coordinate with customers, vendors, security teams, and senior stakeholders to ensure successful delivery and operational stability.

Technical skills

• Area What we expect
• Zscaler Internet Access (ZIA) Policy design, SSL inspection with exception handling, DLP dictionaries, CASB, cloud firewall, sandbox
• Zscaler Private Access (ZPA) App Connector sizing and placement, app segments, access policy, browser access, Private Service Edge
• Zscaler Client Connector Mass deployment, forwarding profiles, trusted network detection, troubleshooting with ZCC logs
• Zscaler Digital Experience (ZDX) Probes, monitors, root cause analysis of user experience issues
• Networking TCP/IP, DNS, DHCP, routing (BGP, OSPF), GRE and IPsec tunnels, proxy chaining, PAC files
• Security fundamentals PKI and certificates, TLS, Zero Trust principles, firewall rules, web proxy behaviour
• Identity SAML 2.0, SCIM, Entra ID, Okta, conditional access
• Logging and SIEM NSS and Cloud NSS feeds to Splunk, Sentinel or QRadar
• Automation Zscaler API, Python, PowerShell or Terraform
• Troubleshooting tools Wireshark, tcpdump, browser developer tools, Zscaler Analyzer

What we look for

Zscaler Internet Access (ZIA) Policy design, SSL inspection with exception handling, DLP dictionaries, CASB, cloud firewall, sandbox
Zscaler Private Access (ZPA) App Connector sizing and placement, app segments, access policy, browser access, Private Service Edge
Zscaler Client Connector Mass deployment, forwarding profiles, trusted network detection, troubleshooting with ZCC logs
Zscaler Digital Experience (ZDX) Probes, monitors, root cause analysis of user experience issues
Networking TCP/IP, DNS, DHCP, routing (BGP, OSPF), GRE and IPsec tunnels, proxy chaining, PAC files
Security fundamentals PKI and certificates, TLS, Zero Trust principles, firewall rules, web proxy behaviour
Identity SAML 2.0, SCIM, Entra ID, Okta, conditional access
Logging and SIEM NSS and Cloud NSS feeds to Splunk, Sentinel or QRadar
Automation Zscaler API, Python, PowerShell or Terraform
Troubleshooting tools Wireshark, tcpdump, browser developer tools, Zscaler Analyzer
Experience and qualifications

The role requires 5 to 7 years of total experience, with a proven record of delivering Zscaler in production.

5 to 7 years in network security, cloud security or infrastructure engineering.
At least 3 years hands-on with Zscaler ZIA and ZPA in enterprise environments.
At least 2 full Zscaler implementations of 1,000 or more users, from design to cutover.
At least 1 migration from a legacy proxy or VPN to Zscaler.
Client-facing consulting or professional services experience.
Bachelor's degree in Computer Science, Information Technology or a related field, or equivalent hands-on experience.
Certifications and additional skills

Certifications (preferred): Zscaler Certified Cloud Professional (ZCCP), Zscaler Certified Cloud Administrator (ZCCA), Zscaler Digital Transformation Engineer (ZDTE), and networking or security credentials such as CCNP Security, PCNSE, CISSP or CCSP.

Nice to have: experience with Netskope, Prisma Access or Cisco Umbrella; exposure to Zscaler Workload Communications, Cloud Connector or Deception; Microsoft 365 and Azure networking; and work in regulated industries such as healthcare, financial services or government.

Soft skills: explains technical designs clearly to engineers and business stakeholders, writes concise and accurate documentation, works independently and owns outcomes, and stays calm and methodical during cutovers and incidents.