Architect - Zero Trust Network Access (ZTNA)

CACI Network Services; Greater London; On-site; GBP 110,000 - 150,000; Full time

Job summary

CACI Network Services in London seeks an Architect to lead the design and evolution of a Zero Trust Network Access (ZTNA) platform for corporate and BYOD devices. You will drive secure access solutions, collaborate with Product Management on backlog priorities, and balance security, scalability, and user experience across a global user base.

The role requires hands-on expertise in VPN/remote access and extensive security architecture experience, with strong documentation and stakeholder

Qualifications

• Hands-on experience delivering VPN, Remote Access, and Cyber Security solutions in large enterprise environments.
• Strong knowledge of networking protocols and technologies including IP Networking, TLS, SSL VPN, IKEv2, RDP.

Responsibilities

• Design, develop, and enhance a global ZTNA solution supporting 100,000+ users.
• Identify opportunities for automation, telemetry improvements, and operational efficiencies.
• Drive platform enhancements and collaborate with vendors to improve product capabilities.
• Provide technical leadership for ZTNA engineering initiatives and roadmap delivery.
• Manage complex technical issues, problem management, and L3 support escalations.
• Create and maintain technical documentation including designs, release notes, and procedures.
• Collaborate with technology, security, and infra teams to meet security and compliance standards.
• Document Zero Trust architecture, standards, and implementation strategies.
• Oversee engineering activities across the ZTNA platform estate.
• Ensure adherence to SDLC, governance, and release processes.

Skills

ZTNA architecture

Networking & security

Troubleshooting

Documentation

Vendor collaboration

Global team experience

Education

Bachelor's degree or equivalent

Agile certification

ITIL certification

Networking/cybersecurity certs desirable

Tools

Palo Alto Prisma Access

Postman

Bruno

Jira

Confluence

Splunk

Fiddler

Wireshark

ServiceNow

Job description

Architect - Zero Trust Network Access (ZTNA)

Location: London
Division/Department: Infrastructure/GTI/End User Computing

Role Overview

The Remote Access team within End User Computing is responsible for delivering secure remote access capabilities for both corporate and BYOD devices across the organisation. Operating within an agile environment, the team is structured into dedicated delivery squads, each focused on a specific technology domain.

The Architect will be responsible for leading the design, engineering, and evolution of the Zero Trust Network Access (ZTNA) platform supporting both corporate and personal iOS, Windows, and macOS devices. This role will drive the development of secure access solutions, work closely with Product Management on backlog refinement and prioritisation, and ensure an optimal balance between security, scalability, and user experience.

Key Responsibilities

• Design, develop, and enhance a global Zero Trust Network Access solution supporting over 100,000 users.
• Identify opportunities for automation, telemetry improvements, and operational efficiencies.
• Drive platform enhancements and work with vendors to improve product capabilities.
• Provide technical leadership for ZTNA engineering initiatives and roadmap delivery.
• Manage complex technical issues, problem management activities, and L3 support escalations.
• Build and maintain technical documentation, including solution designs, release notes, testing documentation, and operational procedures.
• Collaborate with technology, security, and infrastructure teams to ensure solutions meet security, compliance, and engineering standards.
• Design and document Zero Trust architecture, standards, and implementation strategies.
• Oversee engineering activities across the ZTNA platform estate.
• Ensure adherence to SDLC, engineering governance, and release management processes.

Required Skills & Experience

Technical Expertise

• Extensive hands‑on experience delivering VPN, Remote Access, and Cyber Security solutions within large enterprise environments.
• Strong understanding of networking protocols and technologies, including:
  • IP Networking
  • Routing
  • TLS
  • SSL VPN
  • ESP
  • IKEv2
  • ActiveSync
  • ICA
  • RDP
• Experience designing highly available and resilient infrastructure solutions, including:
  • Data Centres
  • Virtualisation Platforms
  • Enterprise Networks
  • Disaster Recovery & Resilience Models
• Strong expertise in Palo Alto Prisma Access and Zero Trust Network Access (ZTNA).
• Understanding of:
  • Citrix
  • Microsoft Azure MFA
  • SAML-based Authentication
  • Azure Active Directory
  • Conditional Access
  • DNS
  • DHCP
  • PKI Certificate Infrastructure
• Experience working with APIs and integration tools such as Postman or Bruno.
• Strong troubleshooting and problem‑solving capabilities in medium to large enterprise environments.

Desirable Skills

• Knowledge of Agile delivery methodologies and best practices.
• Experience with:
  • Jira
  • Confluence
  • Splunk
  • Fiddler
  • Wireshark
  • ServiceNow
• Exposure to Windows, macOS, iOS, and Android platforms.

Education & Certifications

• Bachelor's degree or equivalent qualification.
• Agile and/or ITIL certification preferred.
• Relevant networking and cybersecurity certifications desirable.

Candidate Profile

The successful candidate will be:

• A hands‑on technical expert with strong networking and security architecture experience.
• An excellent communicator with strong documentation skills.
• Comfortable engaging with both technical and non‑technical stakeholders.
• Organised, proactive, and focused on continuous platform improvement.
• Analytical, logical, and solution‑oriented.
• Able to challenge existing designs and processes constructively.
• Experienced working across globally distributed teams and multiple time zones.
• Passionate about staying current with emerging cybersecurity threats and industry best practices.

Key Technologies

Palo Alto Prisma Access | ZTNA | Azure AD | Conditional Access | SAML | VPN | SSL VPN | PKI | DNS | DHCP | Citrix | Wireshark | Splunk | ServiceNow | Jira | Confluence