Key Responsibilities

Tenant Separation & Build-Out

- Build and configure a new Zscaler tenant (ZIA and ZPA) as a full net-current deployment for the retained entity
- Configure ZIA internet security policies (URL filtering, threat protection, DLP, SSL inspection, cloud firewall)
- Configure ZPA access policies, forwarding policies, inspection policies, and isolation policies
- Deploy ZPA App Connectors in retained-entity network segments and validate connectivity
- Establish GRE tunnels from PoP internet routers to the new ZIA cloud instance
- Configure Zscaler Digital Experience (ZDX) monitoring

Identity Integration

- Configure SAML/OIDC federation between the new Zscaler tenant and the shared identity provider (e.g. Okta)
- Implement attribute-based user routing to ensure users are directed to the correct tenant
- Coordinate with the identity team on group/attribute configuration for entity classification
- Validate that users without valid entity classification are denied access to both tenants

Separacy Enforcement

- Implement and validate bidirectional separacy controls — ensuring neither entity's users can access the other's private applications without explicit authorisation
- Configure automated policy audit mechanisms to detect and alert on separacy violations
- Support Day 1 readiness testing including cross-tenant access validation

Transitional Cross-Tenant Access

- Configure Multi-ZPA Tenant Access for explicitly agreed shared services during the transitional period
- Maintain cross-tenant access policies aligned to the transitional services schedule
- Conduct periodic access reviews and revoke access for services that have completed transition

Divested Tenant Cleanup

- Remove retained-entity users, policies, application segments, and App Connectors from the divested tenant
- Reconfigure RBAC and administrative access on the divested tenant for the divested entity's operations team
- Support devolved policy management models for divested teams using IaC/CICD

Transitional Service Operations & Exit

- Provide administration of the divested tenant during the transitional period (platform management, connector management, tunnel management)




- Produce periodic service reports covering availability and incident metrics
- Support handover including admin transfer, IdP migration, and cross-tenant policy removal

Reporting & Analytics

- Configure independent cyber reporting (e.g. Zscaler 360i) for each tenant
- Ensure no cross-entity data leakage in reporting and analytics dashboards

Collaboration & Delivery

- Work with Zscaler Professional Services on tenant provisioning and configuration
- Coordinate with the core routing team on GRE tunnel and internet edge integration
- Collaborate with the workplace team on Client Connector deployment and MDM integration
- Participate in design assurance reviews and produce technical documentation

---

Required Skills & Experience

Zscaler Platform

- Deep hands-on experience administering Zscaler ZIA (URL filtering, threat protection, DLP, SSL inspection, cloud firewall rules)
- Deep hands-on experience administering Zscaler ZPA (access policies, App Connectors, application segments, segment groups, server groups)
- Experience with Zscaler Client Connector deployment and configuration
- Understanding of Zscaler GRE/IPSec tunnel integration for non-Client Connector traffic
- Familiarity with Zscaler Digital Experience (ZDX) monitoring
- Experience with multi-tenant or divestiture scenarios in Zscaler

Identity & Access

- Strong understanding of SAML/OIDC federation and identity provider integration
- Experience with Okta or equivalent enterprise identity provider
- Understanding of attribute-based access control and user routing
- Familiarity with SCIM provisioning for user/group synchronisation

Infrastructure as Code

- Experience managing Zscaler configuration via Terraform (Zscaler Terraform provider)
- Familiarity with CICD pipelines for policy deployment (GitHub Actions or equivalent)
- Understanding of GitOps practices for configuration management





Security & Policy Design

- Strong understanding of zero trust network access (ZTNA) principles
- Experience designing internet security policies (web filtering, threat prevention, DLP)
- Understanding of SSL inspection, certificate management, and bypass policies
- Familiarity with cloud firewall rule design and traffic forwarding policies

VPN & Legacy Remote Access

- Understanding of traditional VPN technologies (Cisco ASA, AnyConnect) and how they relate to/migrate towards ZTNA
- Experience with VPN separation or decommissioning as part of Zscaler adoption programmes
- Familiarity with split-tunnel vs full-tunnel architectures and coexistence with Zscaler Client Connector

Identity & Access Control

- Familiarity with Cisco ISE or equivalent NAC platforms — understanding of how Zscaler integrates with broader identity and access control ecosystems
- Understanding of TACACS+/RADIUS in the context of network device authentication alongside ZTNA

Cloud Security Integration

- Understanding of cloud security architecture in AWS, Azure, and/or GCP (VPC security groups, NSGs, cloud firewalls)
- Familiarity with deploying Zscaler App Connectors and Private Service Edges in cloud environments
- Experience with securing hybrid connectivity (Direct Connect, ExpressRoute, GRE/IPSec tunnels) through Zscaler

Automation, DevOps & Tooling

- Daily use of Git and GitHub (branching, pull requests, code review workflows)
- Working knowledge of Python — able to read, run, and contribute to automation codebases (e.g. Zscaler SDK scripts, policy validation)
- Experience with Terraform for Zscaler configuration management (Zscaler Terraform provider — consuming and contributing to modules)
- Ability to consume and operate CI/CD-driven policy deployment pipelines built by the automation team
- Comfortable working with structured data formats (JSON, YAML, HCL) used in automation templates

General

- Understanding of network fundamentals (routing, DNS, IP addressing) sufficient to configure tunnel integrations
- Experience with change management and controlled policy rollout
- Ability to produce clear technical documentation and runbooks

📌 NEtwork Security (India)
🏢 Trigent Software
📍 India