Senior Network Engineer – Zscaler SME

GDIT is seeking a Senior Network Engineer with deep Zscaler expertise to support the Health Resources & Services Administration (HRSA). You will own the design, operation, and security of HRSA's Zscaler environment while supporting the broader enterprise LAN/WAN, firewall, and remote-access infrastructure. This is a hands-on engineering role working directly with Project Managers, the Office of Information Security and Privacy (OISP), and desktop/server support teams.

How you will make an impact

• Administer, upgrade, and optimize Zscaler Internet Access (ZIA), Private Access (ZPA), and Digital Experience (ZDX), including major/minor releases, reporting, and security blocks.
• Create and maintain ZIA security policies (SSL inspection, URL filtering, DLP, CASB, app control, advanced threat protection) in partnership with OISP.
• Maintain SSO integration between Zscaler and HRSA's Identity Provider (Okta), including SAML attributes and SCIM provisioning.
• Conduct Zscaler Best Practices Assessments and Security Lifecycle Reviews; recommend and implement ruleset changes as security and networking requirements evolve.
• Develop troubleshooting playbooks for Zscaler Client Connector issues and support endpoint and server teams.
• Design, implement, and maintain enterprise LAN/WAN, routing/switching, firewalls, and remote access (IPv4/IPv6).
• Support RSA SecurID / Authentication Manager and its integration with VPN, RADIUS, and LDAP.
• Monitor network performance, lead upgrades and technology refreshes, and coordinate hardware/software procurement as needed.
• Deliver ad-hoc Zscaler reports for leadership and maintain network documentation, diagrams, and SOPs.

What you need to succeed

• Bachelor's degree or equivalent combination of education and experience.
• 8+ years of network engineering experience, including 5+ years hands-on administering Zscaler (ZIA, ZPA, ZDX).
• Strong SASE architecture knowledge and proven Zscaler policy expertise: SSL inspection, URL filtering, DLP, CASB, threat protection.
• Experience integrating Okta or another IdP with Zscaler via SAML/SCIM.
• Strong networking fundamentals (TCP/IP, DNS, routing/switching, IPsec VPN, firewalls) and end-to-end connectivity troubleshooting, including PCAP analysis with Wireshark.
• Hands-on experience with Cisco switching/IOS upgrades and at least one enterprise firewall platform (Cisco ASA/Firepower or Palo Alto/Panorama).
• Experience in federal or enterprise environments with strict compliance and 99.9%+ uptime requirements; familiarity with NIST 800-53, TIC 3.0, and CISA BODs.
• Formal change-management experience and TLS certificate lifecycle management.
• Excellent communication, documentation, and collaboration skills.

Preferred qualifications

• Zscaler Certified Cloud Professional (ZCCP) or Zscaler Certified Cloud Administrator (ZCCA).
• Okta Certified Professional or higher.
• Cisco ISE, RSA SecurID, SolarWinds scripting, Azure networking (NSGs), Riverbed, Grafana, or Cribl.

Location: Rockville, MD – onsite 5 days/week

Clearance: Ability to obtain a Public Trust. Must have resided in the U.S. for 3 of the last 5 years and pass a public trust background investigation.

GDIT is your place: 401(k) with company match, comprehensive health and wellness packages, paid education and certifications, internal mobility support, and cutting-edge technology to learn from.

#GDITFedHealthJobs