Senior Network Security Engineer-(Remote)

The Network Services team is responsible for building, supporting, and optimizing the Compass North American network in all on-premises and cloud environments. The Network Services team works hand in hand with all technology teams within the Enterprise Architecture and Shared Services Technology (EASST) division to support the goals of Compass Technology and Compass Group.

The Sr. Network Security Engineer is responsible for the design, deployment, and support of the organization’s secure network access and zero trust architecture across cloud and on-premises environments. This individual should be familiar with and leverage industry best practices when designing, deploying, configuring, and maintaining secure access solutions that protect users, applications, and data.

The Sr. Network Security Engineer is a technical leader within the Network Services team and is charged to understand the goals/objectives of that team and how it supports those of the Enterprise Architecture and Shared Services Technology division.

This role leads the design, deployment, and operations of the organization’s zero trust architecture, with primary ownership of the Zscaler suite (ZIA, ZPA, and ZTNA) across on-premises and AWS cloud environments. The Sr. Network Security Engineer partners with Cyber Security and Cloud teams to expand the ZPA footprint and advance zero trust access for private applications. An initial focus is a proof of concept evaluating Zscaler’s Zero Trust Exchange as a path to modernize private application connectivity in AWS., * Provide inter-team / inter-technology research, collaboration, design, troubleshooting, and response supporting Compass on-prem and cloud environments

• Lead platform optimization and long-term issue resolution efforts
• Perform backup and restore testing/validation weekly/monthly/quarterly
• Provide tier 3 support for incidents related to any technology owned and supported by the Network Services group
• Serve as subject matter expert for the Zscaler Zero Trust Exchange - ZIA, ZPA, Zscaler Client Connector (ZCC), and ZDX - including tenant configuration, policy design, and lifecycle management
• Deploy, validate, and maintain ZPA App Connectors across AWS, on-premises, and branch environments to broker least-privilege, per-application access
• Design and fine-tune granular access policies, including application segmentation, URL filtering, SSL/TLS inspection, cloud firewall, sandboxing, and data loss prevention (DLP)
• Configure and maintain forwarding profiles, SSL inspection, and secure web gateway controls, tuning for security posture and user experience
• Lead a proof of concept evaluating Zscaler’s Zero Trust Exchange for private application access in AWS, and, based on results, help define the roadmap for modernizing connectivity
• Monitor tenant health, security events, and digital experience using ZDX; troubleshoot client connectivity, authentication, and policy-enforcement issues using logs, packet captures, and HAR files
• Integrate Zscaler with identity providers (Microsoft Entra ID) using SAML and OIDC for SSO, MFA, and conditional access, and support Zscaler Client Connector (ZCC) deployment via endpoint management tools such as Intune
• Participate in incident, problem, and change management within CAB-controlled processes, and author runbooks, standard operating procedures, and network diagrams

Network Security, Cloud Computing, Software Development, Software Engineering, Business Operations, Internet Security, Artificial Intelligence (AI), Enterprise Architecture, Architectural Services, Best Practices, * 5+ years of experience in network security, cybersecurity engineering, or network engineering with a strong security emphasis

• Hands-on experience administering Zscaler ZIA and ZPA at scale, including policy creation, Client Connector deployment, and App Connector hosting
• Practical understanding of Zero Trust Network Access (ZTNA) principles and least-privilege, per-application access models
• Working knowledge of AWS cloud networking (VPCs, route tables, security groups, Transit Gateway, and PrivateLink)
• Strong familiarity with identity and SSO technologies (SAML 2.0, OIDC, Microsoft Entra ID, MFA, and conditional access)
• Solid foundation in core networking: TCP/IP, DNS, DHCP, routing, and SSL/TLS certificates
• Comfortable reading logs, packet captures, and HAR files to isolate and resolve faults
• Highly knowledgeable of security concepts and protocols such as IPSec, SSL/TLS, IDS/IPS, WAF and DDoS protection
• Knowledgeable of cloud and hybrid cloud networks especially AWS networking design principles
• Bachelor’s degree in computer science, or a combination of education and experienceExcellent verbal and written communication skills
• Excellent critical thinking and problem-solving skills
• Positive attitude and solutions-oriented thinking
• Ability to communicate technical concepts to both technical and non-technical audiences

Preferred

• AWS WAF and AWS Firewall Manager experience an asset
• Aviatrix experience an asset
• Scripting and automation with PowerShell, Python, or Terraform (including the Zscaler providers) an asset
• AWS or equivalent cloud certification (AWS-Practitioner)
• Zscaler certification such as ZIA Certified Administrator, ZPA Professional, Zscaler Digital Transformation Administrator (ZDTA), or Zscaler Digital Experience Administrator (ZDXA)
• AWS Advanced Networking Specialty certification
• Security certification such as CompTIA Security+ or SANS/GIAC
• ITIL v3 Foundation’s desirable, Qualified candidates must be able to perform the essential functions of this position satisfactorily with or without a reasonable accommodation. Disclaimer: this job post is not necessarily an exhaustive list of all essential responsibilities, skills, tasks, or requirements associated with this position. While this is intended to be an accurate reflection of the position posted, the Company reserves the right to modify or change the essential functions of the job based on business necessity. We will consider for employment all qualified applicants, including those with a criminal history (including relevant driving history), in a manner consistent with all applicable federal, state, and local laws, including the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the San Francisco Fair Chance Ordinance, and the New York Fair Chance Act.

Salary: $120,000-$140,000

Compass Technology is a dedicated internal team for Compass Group delivering enterprise-wide initiatives that support our diverse customer base and enhance our business operations. Our domain encompasses a vast spectrum of opportunities, from hands-on desk support to Cybersecurity, Cloud Engineering, AI, and Modern Application development. We are committed to building robust IT infrastructures, driving digital transformation, and much more., * Medical

• Dental
• Vision
• Life Insurance/ AD
• Disability Insurance
• Retirement Plan
• Paid Time Off
• Holiday Time Off (varies by site/state)
• Associate Shopping Program
• Health and Wellness Programs
• Discount Marketplace
• Identity Theft Protection
• Pet Insurance
• Commuter Benefits
• Employee Assistance Program
• Flexible Spending Accounts (FSAs)
• Paid Parental Leave
• Personal Leave

Associates may also be eligible for paid and/or unpaid time off benefits in accordance with applicable federal, state, and local laws. For positions in Washington State, Maryland, or to be p formed Remotely, click here or copy/paste the link below for paid time off benefits information.