Security Engineer

OpticoreIT; Greater London; On-site; GBP 111,000 - 138,000; Full time

Benefits offered by this job

On-site work in London (2 days/week)

Job summary

Opticore IT specialises in Network Engineering and Project Management and is seeking a Security Engineer with strong Zscaler expertise for a 6-month IR35 contract in London. The role requires two on-site days per week to support a large-scale divestiture program.

You will implement a new Zscaler tenant (ZIA/ZPA), configure policies, establish inter-tenant federation, and ensure secure cross-tenant operations with audits and monitoring. Prior experience with GRE tunnels and ZDX is prized.

Qualifications

• Experience with Zscaler ZIA and ZPA administration.
• Identity federation skills (SMAL/OIDC, Okta, SCIM).
• Experience with multi-tenant/separation delivery in cloud security.

Responsibilities

• Build and configure Zscaler tenant (ZIA and ZPA) as a full net-new deployment for the retained entity.
• Configure ZIA internet security policies (URL filtering, threat protection, DLP, SSL inspection, cloud firewall).
• Configure ZPA access, forwarding, inspection, and isolation policies; deploy ZPA App Connectors.
• Establish GRE tunnels from PoP internet routers to the ZIA cloud instance; configure ZDX monitoring.
• Configure SAML/OIDC federation and attribute-based user routing between tenants and IdP (e.g. Okta).
• Implement bidirectional separacy controls and automated policy audit mechanisms.

Skills

Zscaler ZIA

Zscaler ZPA

Identity Federation

Okta SCIM

Multi-tenant separation

Zero Trust

GRE/IPSec

Client Connector

Job description

Opticore IT is a specialist Network Engineer and Project Management consultancy offering a wide variety of opportunities to work within fast-paced, challenging environments across our client base spanning multiple sectors including Finance, Broadcast Media, Telecommunications and more.

Opticore IT are currently searching for a Security Engineer who is highly competent with Zscaler to come and join the team for an initial 6 month contract inside IR35 with scope to extend. This opportunity will require two days a week on site in central London.

This opportunity will deliver Zscaler tenant separation, policy build-out, and operational readiness across ZIA and ZPA for a large-scale corporate divestiture programme, building a net-new tenant for the retained entity and ensuring bidirectional separacy between entities ahead of Day 1.

What you'll be doing:

• Build and configure a new Zscaler tenant (ZIA and ZPA) as full net-new deployment for the retained entity
• Configure ZIA internet security policies (URL filtering, threat protection, DLP, SSL inspection, cloud firewall) based on policies defined by the architect.
• Configure ZPA access, forwarding, inspection, and isolation policies; deploy ZPA App Connectors in retained-entity network segments and validate connectivity based on policies defined by the architect.
• Establish GRE tunnels from PoP internet routers to the new ZIA cloud instance and configure Zscaler Digital Experience (ZDX) monitoring
• Configure SAML/OIDC federation and attribute-based user routing between the new tenant and shared identity provider (e.g. Okta)
• Implement and validate bidirectional separacy controls between entities and configure automated policy audit mechanisms to detect and alert on separacy violations
• Configure Multi-ZPA Tenant Access for explicitly agreed shared services during the transitional period, with periodic access reviews
• Remove retained-entity users, policies, application segments, and App Connectors from the divested tenant, and reconfigure RBAC for the divested operations team
• Provide transitional administration of the divested tenant (platform, connector, and tunnel management) and support handover including admin transfer, IdP migration, and cross-tenant policy removal
• Configure independent cyber reporting (e.g. Zscaler 360i) for each tenant to prevent cross-entity data leakage

What you'll bring:

• Zscaler ZIA & ZPA Administration
• Identity Federation (SMAL/OIDC, Okta, SCIM)
• Zscaler Multi-Tenant/Separation Delivery
• Zero Trust Network Access & Policy Design
• Zscaler Client Connector & GRE/IPSec Tunnel Integration

Diversity:

At Opticore IT we embrace diversity and are committed to equal opportunities. We actively recruit for an inclusive and diverse workforce and as such, want to ensure we do everything we can to support your application.

We want you to feel empowered to let us know if you require any adjustments to be made with your application or interview process so please speak to our recruitment team.