Security Engineer

EY is a globally connected professional services organization that uses technology, data, AI, and advanced technology to support clients and build a better working world. EY is seeking a Network Security Engineer - Assistant Director to engineer, deploy, configure, troubleshoot, and optimize Zscaler Cloud, Zscaler Private Access, Zero Trust access, autonomous segmentation, least-privilege policies, and workload segmentation across Azure, data center, VMware, and hybrid environments.

Responsibilities:

• Deploy, configure and troubleshoot Zscaler Cloud and ZPA components including App Connectors, Private Service Edges, application segments, access policies and connector groups
• Lmplement ZPA access models that provide application-level access without extending broad network access to users
• Support onboarding of internal applications, developer services, administrative tools and business workloads into ZPA
• Validate routing, DNS, TLS, SAML, SClM, identity provider and device posture integrations required for successful ZPA deployments
• Maintain engineering documentation, implementation standards, test evidence and operational handover materials
• Bring deep working knowledge of Azure secure networking patterns to support Zscaler integration across EY Azure environments
• Understand, validate and troubleshoot Azure networking components including Virtual WAN, ExpressRoute, Azure Firewall, Application Gateway, Front Door, Private Link and Private Endpoint
• Work with EY Azure architects to integrate Zscaler capabilities with Azure-hosted applications, workloads, Al platforms and infrastructure services
• Translate Azure secure networking requirements into Zscaler engineering patterns, connectivity models and deployment standards
• Partner closely with EY Azure architecture and cloud engineering teams to drive secure Zscaler product integration across Azure environments
• Lmplement ZPA autonomous user-to-application segmentation using discovery data, traffic analysis and policy recommendations
• Use ZPA Policy lnsights, application discovery outputs and segmentation recommendations to validate user-to-application access patterns
• Create granular application segments and access policies aligned to least-privilege principles for users, groups, vendors, contractors and administrators
• Review application-to-user relationships, validate access requirements and remove over-permissive access patterns
• Support migration from VPN and broad network access models to precise ZPA application access policies
• Use ZPA dashboards, logs and diagnostics to monitor segmentation effectiveness and continuously improve policy quality
• Engineer workload segmentation solutions across Azure, data center and hybrid environments
• Deploy and support Zscaler workload and microsegmentation capabilities for workload-to-workload and application-to-application controls
• Define and validate segmentation policies for production, non-production, shared services, management networks and privileged access paths
• Analyze east-west traffic flows and support policy creation to reduce lateral movement risk
• Develop and execute segmentation test plans, validation steps and rollback considerations before production rollout
• Troubleshoot enforcement, connector, routing, certificate, agent and policy issues during segmentation rollout
• Deploy Zscaler App Connectors, Private Service Edges and related components in VMware-based data center environments
• Support secure access and segmentation for applications hosted in traditional data centers and private cloud platforms
• Validate connectivity between on-premises applications, Zscaler services, identity platforms and Azure-hosted workloads
• Assist with migration of legacy applications from network-level access to application-level Zero Trust access
• Work with infrastructure and application teams to test segmentation policies before production rollout
• Build and maintain automation solutions to improve security engineering efficiency
• Automate deployment, configuration validation and policy management activities
• Utilize Terraform, Python, PowerShell, APls and lnfrastructure-as-Code approaches
• Lmprove platform scalability, consistency and operational effectiveness through automation
• Contribute engineering inputs, deployment feedback and technical validation to future-state security engineering plans
• Work under the direction of the Associate Director to implement approved engineering patterns and deployment standards
• Act as a senior hands-on escalation point for Zscaler, ZPA, segmentation, DNS, TLS, routing and authentication issues
• Collaborate with cloud, data center, identity, application and infrastructure teams during design validation, pilot and production rollout
• Provide technical guidance to engineers and support teams involved in onboarding applications and workloads
• Communicate implementation risks, dependencies and progress clearly to the Associate Director and project stakeholders

Requirements:

• Strong hands-on engineering expertise across network security, cloud security and Zero Trust technologies
• Deep troubleshooting and problem-solving capabilities
• Ability to engineer, deploy and validate security solutions at enterprise scale in partnership with platform architecture teams
• Strong understanding of Azure secure networking, hybrid connectivity and cloud security integration patterns
• Experience working across global teams and multiple technology disciplines
• Strong technical communication skills with the ability to explain implementation risks, dependencies and engineering decisions clearly
• Passion for automation, innovation and continuous improvement
• Ability to operate effectively in fast-paced and highly complex environments
• Bachelor's degree in Computer Science, lnformation Technology, Engineering or equivalent experience
• 10-15 years of experience in network security, cloud security or security engineering
• 8-12 years of hands-on experience deploying, configuring or supporting Zscaler technologies
• Strong hands-on experience with Zscaler Private Access, application segments, App Connectors
• Private Service Edges and access policies
• Experience implementing least-privilege access models and user-to-application segmentation using ZPA
• Experience supporting workload segmentation or microsegmentation across cloud, data center or hybrid environments
• Working knowledge of Azure networking, including VNets, routing, Private Link, Private
• Endpoint, ExpressRoute, Azure Firewall and Application Gateway
• Experience deploying security solutions in VMware-based data center environments
• Strong understanding of TCP/lP, DNS, TLS, routing, PKl, identity federation and enterprise networking concepts
• Experience troubleshooting complex connectivity, authentication, policy enforcement and application access issues
• Experience with automation or scripting using Python, PowerShell, Terraform, APls or similar tools
• Strong English communication skills, both written and verbal
• Hands-on experience with ZPA autonomous user-to-app segmentation, ZPA Policy lnsights, Al-
• generated policy recommendations or application discovery workflows
• Experience with Zscaler workload communications, workload segmentation or microsegmentation products
• Experience designing, testing or validating workload-to-workload access control policies
• Experience reducing lateral movement risk and public/private application attack surface through Zero Trust access models
• Experience securing Azure laaS, PaaS, AKS and hybrid application environments
• Experience integrating Zscaler with Microsoft Entra lD, Conditional Access, SClM, SAML and endpoint posture signals
• Strong understanding of SASE, SSE, ZTNA and Zero Trust segmentation architecture
• Zscaler certifications focused on ZPA, ZlA, Client Connector, Private Service Edge, workload segmentation or equivalent hands-on credentials
• Azure Network Engineer Associate or Azure Security Engineer certification
• ClSSP, CCSP, CCNP Security or equivalent certifications