Network Security Engineer

POSITION DESCRIPTION

The Network Security Engineer designs, implements, and operates the company's Zscaler environment and related network security controls. This hands-on role applies zero-trust, secure access, traffic inspection, data protection, identity, cloud, and segmentation controls across enterprise users, applications, and workloads. The position partners with Network Engineering, Security Operations, Cloud Platform, Identity, Application Security, and business technology teams.

QUALIFICATIONS

Required

• 2+ years of network, cloud, or security engineering experience, including significant production experience with Zscaler ZIA, ZPA, and Client Connector.
• Strong knowledge of TCP/IP, routing, DNS, HTTP/S, TLS, certificates, proxies, GRE, IPsec, identity federation, device posture, CASB, and DLP.
• Experience designing secure internet, SaaS, private-application, and cloud-workload connectivity in at least one major public-cloud platform.
• Experience integrating network security platforms with identity, endpoint, certificate, SIEM, and incident-response systems.

Preferred

• Experience with Zscaler Cloud Connector, Zero Trust Gateway, ZDX, Browser Isolation, Cloud NSS, or related Zscaler capabilities.

• Experience with Terraform, Python, PowerShell, REST APIs, Git, or CI/CD automation.
• Zscaler, cloud, networking, or security certifications.

Skills

• Advanced troubleshooting of routing, authentication, certificates, proxies, application connectivity, traffic forwarding, and performance issues.
• Ability to translate security and connectivity requirements into practical, identity- and risk-based policies.
• Strong documentation, project ownership, communication, and cross-functional collaboration skills.
• Ability to balance security, user experience, application performance, and business needs.

OFFICE AND TRAVEL

• Work is primarily performed in an office or remote-work environment using standard computer and collaboration tools.

• Periodic after-hours support, on-call participation, and up to 10% travel may be required.

RESPONSIBILITIES AND TASKS

Main Job Duties (50% of time)

• Design, implement, administer, and troubleshoot ZIA, ZPA, Client Connector, App Connectors, traffic forwarding, TLS inspection, secure web gateway, firewall, threat protection, CASB, and DLP controls.
• Secure employee access to internet, SaaS, and private applications using identity-, device-, risk-, and data-aware policies.
• Design secure connectivity and segmentation for on-premises and cloud workloads, private applications, administrative services, and machine-to-machine communications.
• Integrate Zscaler with identity, endpoint, cloud, certificate, SIEM, and incident-response platforms.

Strategy Management (15% of time)

• Develop and maintain the target architecture and roadmap for Zscaler, zero-trust networking, secure access, and cloud workload protection.
• Partner with business and technical stakeholders to assess user and application access, traffic and data flows, availability needs, performance, and security requirements.

Policy Administration (20% of time)

• Develop, test, document, and maintain access, data-protection, traffic-inspection, segmentation, and exception policies.
• Govern internet, SaaS, and private-application access and protect source code, credentials, intellectual property, customer information, and other sensitive data.

Reporting & Analysis (10% of time)

• Monitor Zscaler logs and develop alerts for threats, sensitive-data exposure, policy bypass, anomalous traffic, and administrative changes.
• Report on platform health, traffic trends, policy effectiveness, exceptions, incidents, and remediation progress.

Other Duties as Assigned (5% of time)

• Automate configuration, validation, reporting, and compliance activities using APIs, scripting, or infrastructure-as-code tools.

• Maintain architecture diagrams, operational procedures, troubleshooting guides, and incident-response runbooks.

PHYSICAL REQUIREMENTS

The physical requirements listed here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Position involves sitting for extended periods of time at employee's workstation and during meetings as well as while traveling, either by plane or car. Employee needs to be able to lift to 20 pounds as frequently as needed to move objects; dexterity to write and manipulate computer keyboard and mouse; ability to hear and speak clearly; and ability to distinguish between colors on graphs and charts.

Occasionally, employee will be required to visit construction jobsites which may expose the employee to dirt, dust, uneven surfaces, outdoor weather conditions and extreme temperatures.

***

In alignment with our commitment to pay transparency, the base salary range for this position is $95,000 to $110,000, excluding fringe benefits or potential bonuses. If you join McGough, your final base salary will be determined by several factors, including geography, location, skills, education, and experience. Furthermore, we place significant value on pay equity among our current team members as part of any final job offer.

Please note that the range provided above reflects the hiring range for this role. Hiring near the top end of this range would be atypical, as we aim to allow room for future salary growth. Additionally, McGough offers a comprehensive compensation and benefits package. This includes insurance coverage for medical, dental, vision, life, and disability. We also provide generous retirement plans, voluntary benefit plans, parental leave, substantial paid time off, and holiday pay.