> Markdown version of [/jobs/ext/4626541-zero-trust-implementation-lead](https://www.wearedevelopers.com/jobs/ext/4626541-zero-trust-implementation-lead). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Zero Trust Implementation Lead

- **Company:** TEKSYSTEMS INC.
- **Location:** Greensboro, NC, United States (Remote available)
- **Experience:** Expert
- **Salary:** $138,674 - $173,327
- **Contract:** Temporary contract
- **Skills:** Microsoft Access, User Authentication, Business Software, Cyber Security, Data Centers, Disaster Recovery, Virtual Private Networks (VPN), Network Security, Microsoft Office, Network Segmentation, Zero Trust Network Access, Runbook, Test Execution Engine, Data Logging, System Availability
- **Published:** November 7, 2026
- **Apply:** https://www.careercircle.com/jobs/all/all/usa/nc/greensboro/889f53df-6946-408c-9516-2f6fbb7669d9

## About the Role

Resilience
Subnetwork
Coordinating
Risk Control
Communication
Test Planning
Cyber Security
Risk Reduction
Authentications
Access Controls
Network Security
Operating Systems
Business Software
Change Management
Endpoint Security
Knowledge Transfer
Business Valuation
Operationalization
Network Engineering
Security Engineering
Network Segmentation
Production Readiness
Test Execution Engine
Full Stack Development
Technical Documentation
Infrastructure Security
Business Transformation
Availability Monitoring
Technical Delivery Management
Virtual Private Networks (VPN)
Troubleshooting (Problem Solving)

At least 8 years, Zscaler, Zscaler Private Access, ZPA, Zscaler Zero Trust Browser, Cyber security, Experience in a large, global, multi-region enterprise environment. Experience supporting retail stores, distribution centers, manufacturing sites, or other operationally sensitive locations. Experience with Zero Trust transformation, internet-facing application reduction, VPN modernization, or firewall decommissioning programs., Individual compensation offered for this position within this range will depend on many factors, including qualifications, skills, relevant experience, job knowledge, geographic location, internal equity, and other pertinent job-related factors.

## Description

We are seeking an experienced Security Engineer to accelerate execution of an enterprise Zero Trust program across a global retail, corporate office, distribution center, and data center environment. The successful contractor will perform hands-on implementation, configuration, testing, troubleshooting, cutover, and operationalization activities across Zscaler access technologies and enterprise network segmentation platforms. The engineer will work directly with application owners and with infrastructure, networking, identity, endpoint, security operations, site operations, and vendor teams. The role is accountable for driving technical workstreams from discovery through production acceptance, resolving implementation barriers, and leaving behind complete operational and audit-ready documentation. Primary Responsibilities Zero Trust implementation Execute technical work supporting the enterprise Zero Trust roadmap and approved target-state patterns. Translate approved designs into
production configurations, implementation plans, test plans, rollback procedures, and operational runbooks. Implement least-privilege, identity-aware, application-specific access controls using approved enterprise platforms. Validate production readiness, high availability, monitoring, logging, support ownership, and recovery procedures. Zscaler Private Access and Browser Access Inventory and validate externally exposed or broadly reachable applications and confirm business and technical ownership. Configure Zscaler Private Access application segments, server groups, access policies, identity dependencies, posture requirements, and related infrastructure. Migrate eligible applications (internal or external) to Zscaler Private Access or Browser Access and support testing, cutover, troubleshooting, and production validation. Coordinate removal of direct internet exposure to migrated applications after acceptance criteria are met. Support isolated-browser or clientless access patterns where
approved and appropriate. Implement internal segmentation of internal high-priority services using Zscaler Private Access. Test and troubleshoot segmentation changes while maintaining operational continuity and documented rollback capability. Create migration playbooks for all performed activities. Primary Responsibilities, Continued Legacy operating-system isolation Identify reachable legacy and end-of-life systems that require compensating controls. Implement containment zones, restricted communication paths, approved administrative access, jump-host or privileged-access dependencies, and enhanced monitoring. Validate business, application, backup, monitoring, service-account, and recovery dependencies before enforcement. Document exceptions, residual risk, control evidence, expiration dates, and remediation or retirement ownership. Cross-functional technical coordination Act as the primary implementation lead coordinating application owners, Infrastructure Engineering, Network
Engineering, Identity, Endpoint, Security Operations, site operations, vendors, and change management. Facilitate technical discovery sessions to document application dependencies, communication flows, authentication requirements, testing responsibilities, and acceptance criteria. Drive implementation schedules, task ownership, testing windows, production cutovers, issue resolution, and operational handoff. Maintain a clear blocker and dependency log, escalate decision points with evidence, and keep stakeholders aligned on outcomes and timing. Coordinate global and site-specific changes while respecting business operating windows, change freezes, and local support requirements. Operational readiness and governance Produce accurate diagrams, test evidence, rollback procedures, runbooks, and support documentation. Provide weekly status reporting based on production outcomes, risk reduction, blockers, exceptions, and upcoming changes. Perform knowledge transfer and paired implementation with
designated internal engineers before engagement completion. Required Qualifications 8+ years of hands-on security engineering, network security engineering, infrastructure security, or closely related enterprise implementation experience. Demonstrated production implementation experience with Zscaler Private Access, including App Connectors, application segments, server groups, access policy, identity integration, logging, high availability, and troubleshooting. Experience implementing or supporting Zscaler Browser Access or equivalent clientless/private-application access patterns. Experience implementing segmentation or compensating controls for legacy and end-of-life operating systems, including jump-host and privileged-access dependencies. Proven experience leading application-owner discovery, documenting required flows, challenging broad-access requests, and gaining production acceptance. Experience supporting formal change management, production change windows, test execution,
rollback, troubleshooting, and post-change validation. Ability to independently produce clear technical documentation, implementation artifacts, operational runbooks, diagrams, risk records, and executive-ready status updates. Preferred Qualifications Experience in a large, global, multi-region enterprise environment. Experience supporting retail stores, distribution centers, manufacturing sites, or other operationally sensitive locations. Experience with Zero Trust transformation, internet-facing application reduction, VPN modernization, or firewall decommissioning programs. Expected Deliverables Application protection Prioritized application inventory, owner validation, completed ZPA or Browser Access migrations, production acceptance evidence, and removal or formal exception of direct exposure. ZPA configuration quality Remediation of selected high-risk issues such as wildcard segments, broad subnets, over-permissive ports, connector resilience, server discovery, logging, and
access-policy gaps. Network segmentation Production-ready segmentation patterns and implemented controls across prioritized office, retail, data center, or distribution center environments. Legacy-system containment Priority legacy assets placed behind enforceable boundary controls with approved administrative paths, monitoring, exceptions, and accountable remediation owners. Operational readiness MOPs, test and rollback evidence, diagrams, rule matrices, runbooks, configuration records, named support ownership, and knowledge transfer. Program visibility Weekly milestone reporting, blocker and dependency tracking, risk and exception status, and measurable implementation outcomes.