Network Security Engineer

McGough; United States; Hybrid; USD 95,000 - 110,000; Full time

Benefits offered by this job

Medical, dental, vision

Retirement plans

Parental leave

Generous paid time off

Holiday pay

Job summary

McGough is seeking a Network Security Engineer to design, implement, and operate its Zscaler environment and related security controls. You will apply zero‑trust, secure access, traffic inspection, data protection, identity, cloud, and segmentation controls across enterprise users, applications, and workloads.

You will partner with Network Engineering, Security Operations, Cloud Platform, Identity, and Application Security teams to deliver secure, scalable connectivity and policy governance

Qualifications

• 2+ years in network, cloud, or security engineering with production Zscaler experience.
• Strong knowledge of TCP/IP, routing, DNS, HTTP/S, TLS, certificates, proxies, and DLP.
• Experience designing secure internet, SaaS, private‑application, and cloud workloads in at least one major public cloud.
• Experience integrating security platforms with identity, endpoint, certificate, SIEM and IR systems.

Responsibilities

• Design, implement, administer, and troubleshoot ZIA, ZPA, Client Connector, App Connectors, traffic forwarding, TLS inspection, and DLP controls.
• Secure employee access to internet, SaaS, and private apps using identity and data‑aware policies.
• Design secure connectivity and segmentation for on‑premises and cloud workloads.
• Integrate Zscaler with identity, endpoint, cloud, certificate, SIEM, and IR platforms.

Skills

Zscaler ZIA/ZPA

TCP/IP knowledge

Secure connectivity design

Documentation & collaboration

Tools

Terraform

Python

PowerShell

REST APIs

Git

CI/CD

Job description

POSITION DESCRIPTION

The Network Security Engineer designs, implements, and operates the company’s Zscaler environment and related network security controls. This hands‑on role applies zero‑trust, secure access, traffic inspection, data protection, identity, cloud, and segmentation controls across enterprise users, applications, and workloads. The position partners with Network Engineering, Security Operations, Cloud Platform, Identity, Application Security, and business technology teams.

QUALIFICATIONS

Required

• 2+ years of network, cloud, or security engineering experience, including significant production experience with Zscaler ZIA, ZPA, and Client Connector.
• Strong knowledge of TCP/IP, routing, DNS, HTTP/S, TLS, certificates, proxies, GRE, IPsec, identity federation, device posture, CASB, and DLP.
• Experience designing secure internet, SaaS, private‑application, and cloud‑workload connectivity in at least one major public‑cloud platform.
• Experience integrating network security platforms with identity, endpoint, certificate, SIEM, and incident‑response systems.

Preferred

• Experience with Zscaler Cloud Connector, Zero Trust Gateway, ZDX, Browser Isolation, Cloud NSS, or related Zscaler capabilities.
• Experience with Terraform, Python, PowerShell, REST APIs, Git, or CI/CD automation.
• Zscaler, cloud, networking, or security certifications.

Skills

• Advanced troubleshooting of routing, authentication, certificates, proxies, application connectivity, traffic forwarding, and performance issues.
• Ability to translate security and connectivity requirements into practical, identity‑and‑risk‑based policies.
• Strong documentation, project ownership, communication, and cross‑functional collaboration skills.
• Ability to balance security, user experience, application performance, and business needs.

OFFICE AND TRAVEL

• Work is primarily performed in an office or remote‑work environment using standard computer and collaboration tools.
• Periodic after‑hours support, on‑call participation, and up to 10% travel may be required.

RESPONSIBILITIES AND TASKS

Main Job Duties (50% of time)

• Design, implement, administer, and troubleshoot ZIA, ZPA, Client Connector, App Connectors, traffic forwarding, TLS inspection, secure web gateway, firewall, threat protection, CASB, and DLP controls.
• Secure employee access to internet, SaaS, and private applications using identity‑, device‑, risk‑, and data‑aware policies.
• Design secure connectivity and segmentation for on‑premises and cloud workloads, private applications, administrative services, and machine‑to‑machine communications.
• Integrate Zscaler with identity, endpoint, cloud, certificate, SIEM, and incident‑response platforms.

Strategy Management (15% of time)

• Develop and maintain the target architecture and roadmap for Zscaler, zero‑trust networking, secure access, and cloud workload protection.
• Partner with business and technical stakeholders to assess user and application access, traffic and data flows, availability needs, performance, and security requirements.

Policy Administration (20% of time)

• Develop, test, document, and maintain access, data‑protection, traffic‑inspection, segmentation, and exception policies.
• Govern internet, SaaS, and private‑application access and protect source code, credentials, intellectual property, customer information, and other sensitive data.

Reporting & Analysis (10% of time)

• Monitor Zscaler logs and develop alerts for threats, sensitive‑data exposure, policy bypass, anomalous traffic, and administrative changes.
• Report on platform health, traffic trends, policy effectiveness, exceptions, incidents, and remediation progress.

Other Duties as Assigned (5% of time)

• Automate configuration, validation, reporting, and compliance activities using APIs, scripting, or infrastructure‑as‑code tools.
• Maintain architecture diagrams, operational procedures, troubleshooting guides, and incident‑response runbooks.

PHYSICAL REQUIREMENTS

The physical requirements listed here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Position involves sitting for extended periods of time at employee’s workstation and during meetings as well as while traveling, either by plane or car. Employee needs to be able to lift to 20 pounds as frequently as needed to move objects; dexterity to write and manipulate computer keyboard and mouse; ability to hear and speak clearly; and ability to distinguish between colors on graphs and charts.

Occasionally, employee will be required to visit construction jobsites which may expose the employee to dirt, dust, uneven surfaces, outdoor weather conditions and extreme temperatures.

In alignment with our commitment to pay transparency, the base salary range for this position is $95,000 to $110,000, excluding fringe benefits or potential bonuses. If you join McGough, your final base salary will be determined by several factors, including geography, location, skills, education, and experience. Furthermore, we place significant value on pay equity among our current team members as part of any final job offer.

Please note that the range provided above reflects the hiring range for this role. Hiring near the top end of this range would be atypical, as we aim to allow room for future salary growth. Additionally, McGough offers a comprehensive compensation and benefits package. This includes insurance coverage for medical, dental, vision, life, and disability. We also provide generous retirement plans, voluntary benefit plans, parental leave, substantial paid time off, and holiday pay.