Zero Trust Implementation Lead

Description

We are seeking an experienced Security Engineer to accelerate execution of an enterprise Zero Trust program across a global retail, corporate office, distribution center, and data center environment. The successful contractor will perform hands-on implementation, configuration, testing, troubleshooting, cutover, and operationalization activities across Zscaler access technologies and enterprise network segmentation platforms. The engineer will work directly with application owners and with infrastructure, networking, identity, endpoint, security operations, site operations, and vendor teams. The role is accountable for driving technical workstreams from discovery through production acceptance, resolving implementation barriers, and leaving behind complete operational and audit-ready documentation.

Primary Responsibilities Zero Trust implementation Execute technical work supporting the enterprise Zero Trust roadmap and approved target-state patterns. Translate approved designs into production configurations, implementation plans, test plans, rollback procedures, and operational runbooks. Implement least-privilege, identity-aware, application-specific access controls using approved enterprise platforms. Validate production readiness, high availability, monitoring, logging, support ownership, and recovery procedures. Zscaler Private Access and Browser Access Inventory and validate externally exposed or broadly reachable applications and confirm business and technical ownership. Configure Zscaler Private Access application segments, server groups, access policies, identity dependencies, posture requirements, and related infrastructure. Migrate eligible applications (internal or external) to Zscaler Private Access or Browser Access and support testing, cutover, troubleshooting, and production validation. Coordinate removal of direct internet exposure to migrated applications after acceptance criteria are met. Support isolated-browser or clientless access patterns where approved and appropriate. Implement internal segmentation of internal high-priority services using Zscaler Private Access. Test and troubleshoot segmentation changes while maintaining operational continuity and documented rollback capability. Create migration playbooks for all performed activities. Primary Responsibilities, Continued Legacy operating-system isolation Identify reachable legacy and end-of-life systems that require compensating controls. Implement containment zones, restricted communication paths, approved administrative access, jump-host or privileged-access dependencies, and enhanced monitoring. Validate business, application, backup, monitoring, service-account, and recovery dependencies before enforcement. Document exceptions, residual risk, control evidence, expiration dates, and remediation or retirement ownership. Cross-functional technical coordination Act as the primary implementation lead coordinating application owners, Infrastructure Engineering, Network Engineering, Identity, Endpoint, Security Operations, site operations, vendors, and change management. Facilitate technical discovery sessions to document application dependencies, communication flows, authentication requirements, testing responsibilities, and acceptance criteria. Drive implementation schedules, task ownership, testing windows, production cutovers, issue resolution, and operational handoff. Maintain a clear blocker and dependency log, escalate decision points with evidence, and keep stakeholders aligned on outcomes and timing. Coordinate global and site-specific changes while respecting business operating windows, change freezes, and local support requirements. Operational readiness and governance Produce accurate diagrams, test evidence, rollback procedures, runbooks, and support documentation. Provide weekly status reporting based on production outcomes, risk reduction, blockers, exceptions, and upcoming changes. Perform knowledge transfer and paired implementation with designated internal engineers before engagement completion. Required Qualifications 8+ years of hands-on security engineering, network security engineering, infrastructure security, or closely related enterprise implementation experience. Demonstrated production implementation experience with Zscaler Private Access, including App Connectors, application segments, server groups, access policy, identity integration, logging, high availability, and troubleshooting. Experience implementing or supporting Zscaler Browser Access or equivalent clientless/private-application access patterns. Experience implementing segmentation or compensating controls for legacy and end-of-life operating systems, including jump-host and privileged-access dependencies. Proven experience leading application-owner discovery, documenting required flows, challenging broad-access requests, and gaining production acceptance. Experience supporting formal change management, production change windows, test execution, rollback, troubleshooting, and post-change validation. Ability to independently produce clear technical documentation, implementation artifacts, operational runbooks, diagrams, risk records, and executive-ready status updates. Preferred Qualifications Experience in a large, global, multi-region enterprise environment. Experience supporting retail stores, distribution centers, manufacturing sites, or other operationally sensitive locations. Experience with Zero Trust transformation, internet-facing application reduction, VPN modernization, or firewall decommissioning programs. Expected Deliverables Application protection Prioritized application inventory, owner validation, completed ZPA or Browser Access migrations, production acceptance evidence, and removal or formal exception of direct exposure. ZPA configuration quality Remediation of selected high-risk issues such as wildcard segments, broad subnets, over-permissive ports, connector resilience, server discovery, logging, and access-policy gaps. Network segmentation Production-ready segmentation patterns and implemented controls across prioritized office, retail, data center, or distribution center environments. Legacy-system containment Priority legacy assets placed behind enforceable boundary controls with approved administrative paths, monitoring, exceptions, and accountable remediation owners. Operational readiness MOPs, test and rollback evidence, diagrams, rule matrices, runbooks, configuration records, named support ownership, and knowledge transfer. Program visibility Weekly milestone reporting, blocker and dependency tracking, risk and exception status, and measurable implementation outcomes.

Skills

Zscaler, Zscaler Private Access, ZPA, Zscaler Zero Trust Browser, Cyber security

Top Skills Details

Zscaler,Zscaler Private Access,ZPA,Zscaler Zero Trust Browser,Cyber security

Additional Skills & Qualifications

Experience in a large, global, multi-region enterprise environment. Experience supporting retail stores, distribution centers, manufacturing sites, or other operationally sensitive locations. Experience with Zero Trust transformation, internet-facing application reduction, VPN modernization, or firewall decommissioning programs.

Experience Level

Expert Level

Job Type & LocationThis is a Contract position based out of Greensboro, NC. Pay and BenefitsThe pay range for this position is $66.67 - $83.33/hr. Individual compensation offered for this position within this range will depend on many factors, including qualifications, skills, relevant experience, job knowledge, geographic location, internal equity, and other pertinent job-related factors.Eligibility requirements apply to some benefits and may depend on your job classification and length of employment. Benefits are subject to change and may be subject to specific elections, plan, or program terms. If eligible, the benefits

available for this temporary role may include the following:

Medical, dental & vision Critical Illness, Accident, and Hospital 401(k) Retirement Plan Pre-tax and Roth post-tax contributions available Life Insurance (Voluntary Life & AD&D for the employee and dependents) Short and long-term disability Health Spending Account (HSA) Transportation benefits Employee Assistance Program Time Off/Leave (PTO, Vacation or Sick Leave) Job Type & LocationThis is a Contract position based out of Greensboro, NC. Application DeadlineThis position is anticipated to close on Nov 20, 2026. Workplace TypeThis is a hybrid position in Greensboro,NC.

About TEKsystems

We're partners in transformation. We help clients activate ideas and solutions to take advantage of a new world of opportunity. We are a team of 80,000 strong, working with over 6,000 clients, including 80% of the Fortune 500, across North America, Europe and Asia. As an industry leader in Full-Stack Technology Services, Talent Services, and real-world application, we work with progressive leaders to drive change. That's the power of true partnership. TEKsystems is an Allegis Group company.

The company is an equal opportunity employer and will consider all applications without regards to race, sex, age, color, religion, national origin, veteran status, disability, sexual orientation, gender identity, genetic information or any characteristic protected by law.

About TEKsystems and TEKsystems Global Services

Were a leading provider of business and technology services. We accelerate business transformation for our customers. Our expertise in strategy, design, execution and operations unlocks business value through a range of solutions. Were a team of 80,000 strong, working with over 6,000 customers, including 80% of the Fortune 500 across North America, Europe and Asia, who partner with us for our scale, full-stack capabilities and speed. Were strategic thinkers, hands-on collaborators, helping customers capitalize on change and master the momentum of technology. Were building tomorrow by delivering business outcomes and making positive impacts in our global communities. TEKsystems and TEKsystems Global Services are Allegis Group companies. Learn more at TEKsystems.com.

The company is an equal opportunity employer and will consider all applications without regard to race, sex, age, color, religion, national origin, veteran status, disability, sexual orientation, gender identity, genetic information or any characteristic protected by law.

San Francisco Fair Chance Ordinance: Pursuant to the San Francisco Fair Chance Ordinance, for all positions located in the city and county of San Francisco, we will consider for employment qualified applicants with arrest and conviction records.

Massachusetts Lie Detector: It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.

Use of Artificial Intelligence (AI): We may use Artificial Intelligence (AI) to support parts of our hiring process, including sourcing, screening, and evaluating candidates. AI helps assess applications and qualifications, but final decisions are made by our hiring team. By applying, you acknowledge and agree that your application may be reviewed using AI tools.