> Markdown version of [/jobs/ext/3963579-staff-network-security-architect](https://www.wearedevelopers.com/jobs/ext/3963579-staff-network-security-architect). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Staff Network Security Architect

- **Company:** Zoox
- **Location:** Foster City, CA, United States
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Microsoft Access, IEEE 802.1X, Artificial Intelligence, Amazon Web Services, Border Gateway Protocol, Cloud Computing Security, Cyber Security, Continuous Integration, Data Centers, Supervisory Control and Data Acquisition (SCADA), Intrusion Detection Systems, Virtual Private Networks (VPN), Information Systems Security Architecture Professional, Network Security, Network Architecture, Open Shortest Path First (OSPF), Public Key Infrastructure, Remote Access Technology, Zero Trust Network Access, Sherwood Applied Business Security Architecture, Software Engineering, Data Streaming, TCP/IP, Virtual Local Area Networks, Wide Area Networks, Data Logging, Cloud-native Network Functions (CNF), Transport Layer Security, Google Cloud, Large Language Models, Software Security, Safety Critical Systems, Multi-Cloud, HybridCloud, Togaf, National Institute of Standards and Technology Cybersecurity Framework, Fortinet, Terraform
- **Published:** October 27, 2026
- **Apply:** https://www.careerbuilder.com/job-details/staff-network-security-architect-foster-city-ca--3b4173fb-3290-49b7-8dc3-7915b35c456f

## About the Role

Security Architecture, Network Security, Network Architecture/Engineering, Network Security, Network Architecture/Engineering, Security Architecture, Amazon Web Services (AWS), Security Design, Software Engineering, GCP (Good Clinical Practices), * 10+ years in network and security engineering, including 4+ years in an architecture or technical-lead role where you owned designs others implemented

 * Demonstrated ownership of an enterprise-scale segmentation or zero-trust architecture from concept through adoption, including what you changed when it met reality
 * Ability to reason about security frameworks as design inputs, not audit artifacts: fluency with NIST CSF 2.0, NIST 800-53, and ISO 27001, and a track record of turning them into engineering standards and evidence
 * Depth in threat modeling and secure-by-design for network and infrastructure, including data flow analysis, trust boundaries, blast radius, and failure modes
 * Strong platform grounding to keep designs buildable: next-gen firewalls (Palo Alto, Fortinet), AWS NFW, IDS/IPS, NAC/802.1X, PKI, VPN, ZTNA (Zscaler, Prisma Access, or equivalent), and core protocols (TCP/IP, BGP, OSPF, VLAN, TLS/PKI)
 * Cloud network security depth in AWS and/or GCP, including inspection architecture, cloud-native enforcement, and IaC delivery with Terraform, * OT, ICS, robotics, automotive, or manufacturing network security experience (IEC 62443, Purdue model, or equivalent)
 * Autonomous vehicle or safety-critical systems exposure
 * Certifications: CISSP-ISSAP, SABSA, TOGAF, CCIE Security, PCNSE, AWS Security Specialty
 * Experience applying AI/ML to network or cloud security (anomaly detection, behavioral analytics, LLM-assisted design review or policy analysis)

## Description

Zoox's Network Security team architects and defends the digital borders of the company, from corporate offices to engineering labs and product/mission environments. As Staff Network Security Architect, you own the target-state design for how Zoox segments, connects, and controls trust across enterprise IT, OT and lab networks, and hybrid cloud (AWS, GCP). You set the standards other teams build to, you are the security design authority on new infrastructure, and you are accountable for the coherence of the whole picture rather than the health of any one platform. You'll partner closely with Network Engineering, IT, Product Security, Hardware, and Software Engineering, and you'll influence far more systems than you personally operate., * Own Zoox's network security reference architecture across corporate, data center, lab/OT, and edge environments, and define the segmentation and trust model that everything else is built against

 * Serve as the security design authority for new infrastructure: run design reviews and threat models early enough to change the design, and define the criteria under which a design is approved, conditionally approved, or rejected
 * Translate security frameworks into buildable engineering standards. Map controls to NIST CSF 2.0, NIST 800-53, and ISO 27001 (IEC 62443 a plus for OT/lab), and turn them into reference patterns, guardrails, and acceptance criteria engineers can implement without interpreting policy
 * Define the zero-trust and identity-to-network strategy, including 802.1X/certificate-based NAC, PKI trust hierarchy, ZTNA and remote access, and how non-human and headless lab/vehicle assets are authenticated and authorized
 * Architect secure hybrid and multi-cloud connectivity (CloudWAN, SD-WAN, transit and inspection architectures, cloud-native controls) and define where inspection, enforcement, and logging belong
 * Drive secure-by-design into the delivery path: encode standards as Terraform modules, policy-as-code, and CI/CD guardrails so the secure pattern is the default one, not a review gate
 * Own data flow and trust boundary analysis for sensitive environments, including vehicle data, lab telemetry, and third-party and vendor connectivity
 * Own the governance side of architecture: risk articulation for leadership, exception and compensating control decisions, architecture decision records, and the multi-year roadmap that retires legacy patterns
 * Set technical direction and raise the bar across the team through mentorship, design review, and written standards rather than through direct ownership of day-to-day operations