Network Security Engineer SME (Top Secret Clearance Required)

About the Role

ZaphyrRecruit is seeking an experienced Network Security Engineer (SME) to lead a high-impact Zero Trust transformation for a major Federal Client. In this pivotal role, you will drive the migration from legacy network security infrastructure to a modern, cloud-first architecture powered by Zscaler.

You will play a central role in implementing cutting-edge security capabilities aligned with Trusted Internet Connections (TIC) 3.0 while working alongside an experienced engineering team in a mature SAFe Agile environment. This position offers a unique combination of hands-on engineering, architecture design, and transformation leadership, allowing you to shape future-state architecture, solve complex enterprise challenges at scale, and deliver critical security enhancements.

Key Highlights & Work Culture

●     High-Impact Mission: Directly contribute to modernizing federal security posture, enabling secure, cloud-first access, and reducing reliance on legacy backhaul infrastructure.

●     Collaborative Environment: Work within a collaborative team of federal and contractor personnel where teamwork, technical excellence, and shared accountability are highly valued.

●     Professional Growth: Gain enterprise-scale hands-on experience with Zscaler (ZIA & ZPA), Zero Trust / SASE frameworks, federal modernization standards (TIC 3.0), and cloud security integration.

Typical Day & Operating Model

You will operate within a mature SAFe Agile methodology using two-week sprint cycles tracked via Jira and Confluence:

●     Participate in daily stand-ups and Agile ceremonies to align priorities and address blockers.

●     Work on prioritized features and user stories while concurrently supporting ongoing Operations & Maintenance (O&M) activities (e.g., ticket resolution, vulnerability management, and sustainment).

●     Communicate and coordinate across teams primarily through Microsoft collaboration tools and Jira boards.

Key Responsibilities

●     Zero Trust & Cloud Security Implementation: Lead the enterprise implementation and optimization of Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) to support Zero Trust and SASE framework objectives.

●     Migration Strategy & Architecture: Develop and execute strategies to transition

from legacy forward proxies and traditional VPNs to Zscaler cloud-based architectures; design direct-to-cloud connectivity solutions that eliminate on-premises traffic backhaul.

●     Policy & Control Optimization: Configure and optimize Zscaler policies, including URL filtering, SSL inspection, Data Loss Prevention (DLP), and granular access controls.

●     Identity & Access Management Integration: Integrate Zscaler solutions with enterprise Identity Providers (e.g., Active Directory, Azure AD, SAML/OIDC) to enforce strict, identity-driven access policies.

●     Cross-Functional Collaboration: Partner with cross-functional network, security, and cloud engineering teams to support TIC 3.0-aligned security architectures.

●     Troubleshooting & Operations: Resolve complex network security issues (traffic flow, policy enforcement, access issues) and support O&M duties, including vulnerability remediation and system sustainment.

●     Technical Documentation: Author and maintain architectural diagrams, migration plans, standard operating procedures (SOPs), and operational guides.

Required Qualifications

●     Experience: 10 years of network security or cybersecurity engineering experience (a relevant degree may substitute for a portion of experience).

●     Hands-on Platforms: Hands-on experience with Zscaler (ZIA/ZPA) or comparable cloud security, Secure Web Gateway (SWG), or Zero Trust Network Access (ZTNA) platforms.

●     Technical Leadership: Proven track record as a technical lead or SME on complex enterprise network/security initiatives.

●     Migration Expertise: Demonstrated experience supporting large-scale network security migrations (e.g., replacing legacy proxy/VPN solutions with cloud-based or Zero Trust architectures).

●     Identity & Access Integration: Experience integrating security solutions with enterprise identity providers (Active Directory, Azure AD, SAML/OIDC).

●     Core Networking & Security: Solid foundation in enterprise networking and security technologies, including firewalls (Palo Alto, Cisco, etc.), routing protocols, DNS, and proxy architectures.

●     SIEM & Logging: Hands-on experience with enterprise SIEM and logging platforms (Splunk preferred).

●     Security Clearance: Active Top Secret Clearance.

●     Citizenship: U.S. Citizenship is strictly required.

Desired / Preferred Qualifications

Certifications:

○     Z-scaler Certifications: ZDTA, ZDTE, ZCCA-IA, ZCCA-PA, or similar.

○     Security Certifications: Security , CASP/X, CISSP, or equivalent.

○     Networking Certifications: CCNA, CCNP, or equivalent.

●     Federal Standards & Architecture: Familiarity with CISA TIC 3.0 guidelines, NIST Zero Trust Architecture (ZTA), and SASE frameworks.

●     Cloud Platforms: Experience with public cloud environments (AWS and/or Azure), including networking and security integrations.

Agile Framework: Experience working in a SAFe Agile environment utilizing Jira and Confluence for workflow management.

ZaphyrRecruit is hiring on behalf of a premier, woman-owned turnkey specialty contractor based in the Baltimore area. Serving Maryland, Washington, D.C., and Northern Virginia, the company delivers complete turnkey solutions for Division 6 (Finish Carpentry), Division 8 (Doors, Frames & Hardware), and Division 10 (Specialty Products) on major commercial and multifamily developments. Known for operational excellence, integrity, and customer satisfaction, they offer a fast-paced environment with strong performance incentives and direct career advancement paths.