Role Specification :

We are seeking an experienced Zscaler Security Engineer to deliver tenant separation, policy build-out, and operational readiness activities for the Zscaler platform (ZIA and ZPA) as part of a large-scale corporate divestiture programme.

Key Responsibilities :

- Build and configure a new Zscaler tenant (ZIA and ZPA) as a full net-new deployment for the retained entity

- Configure ZIA internet security policies (URL filtering, threat protection, DLP, SSL inspection, cloud firewall)

- Configure ZPA access policies, forwarding policies, inspection policies, and isolation policies

- Deploy ZPA App Connectors in retained-entity network segments and validate connectivity

- Establish GRE tunnels from PoP internet routers to the new ZIA cloud instance

- Configure Zscaler Digital Experience (ZDX) monitoring

- Configure SAML/OIDC federation between the new Zscaler tenant and the shared identity provider (e.g. Okta)

- Implement and validate bidirectional separacy controls

- Configure Multi-ZPA Tenant Access for transitional services

- Provide administration of the divested tenant during the transitional period

Tech Stack & Requirements :

Zscaler Platform : Deep hands-on experience administering Zscaler ZIA and ZPA, Client Connector, and GRE/IPSec tunnel integration.

Identity & Access : Strong understanding of SAML/OIDC federation, Okta, and attribute-based access control.

Infrastructure as Code : Experience managing Zscaler configuration via Terraform and CI/CD pipelines (GitHub Actions).

Security & Policy Design : Strong understanding of ZTNA principles, SSL inspection, and cloud firewall design.

Automation : Working knowledge of Python and Git/GitHub workflows.

General : Understanding of network fundamentals (routing, DNS, IP addressing).

Desirable Skills : ZCCP certification, experience with Zscaler 360i, and knowledge of network separation/divestiture programmes.