SASE Security Consultant — Zero Trust Lead (Remote/On-site)

AHEAD; United States; On-site; USD 120,000 - 160,000; Full time

Benefits offered by this job

Medical, Dental, Vision Insurance

401(k)

Paid holidays

Paid time off

Travel opportunities

Certifications sponsorship

Job summary

AHEAD seeks a Technical Consultant to deliver SASE and SSE engagements for enterprise clients in the United States. The role covers configuring and operating Zero Trust architectures across four core platforms and leading remote and on-site deployment workstreams, following a design from a Senior or Principal Consultant.

You will own hands-on configuration, testing, and knowledge transfer for assigned workstreams, contribute to client-facing documentation, and mentor junior engineers while

Qualifications

• 3 to 5 years of network security, infrastructure security, or security engineering experience, including client-facing or internal project delivery experience.
• Production experience configuring at least one of the following SASE/SSE platforms: Zscaler (ZIA and ZPA), Palo Alto Prisma Access, Cisco Secure Access, or Netskope Security Cloud.
• Working knowledge of Zero Trust architecture principles, Secure Web Gateway, CASB, and ZTNA concepts across the broader SASE/SSE platform landscape.
• Understanding of identity and access management integration (Okta, Microsoft Entra ID, SAML 2.0, SCIM) with SASE/SSE policy enforcement.
• Familiarity with routing and connectivity fundamentals (BGP, OSPF, IPsec, GRE) sufficient to implement traffic forwarding designs provided by an architect.
• Ability to produce clear technical documentation and communicate configuration status and issues to both technical and non-technical stakeholders.
• Ability to travel at least 25 percent.

Responsibilities

• Configure and deploy Zscaler Internet Access (ZIA) components including policy, SSL inspection, URL filtering, cloud firewall rules, and sandbox policy against an established design.
• Configure Zscaler Private Access (ZPA) application segments, App Connectors, and browser-based access for Zero Trust remote access.
• Configure Palo Alto Prisma Access GlobalProtect remote user connectivity and explicit proxy setup for branch offices, plus service connections to on-premises infrastructure.
• Configure Cisco Secure Access Zero Trust Network Access, Secure Web Gateway, CASB, and resource connectors for private application access.
• Configure Netskope Security Cloud Next Gen SWG, CASB, and Netskope Private Access traffic steering and policy enforcement.
• Implement traffic forwarding methods including GRE tunnels, IPsec tunnels, PAC files, and client connectors according to the design.
• Configure identity-based access controls integrating with Okta, Microsoft Entra ID, SAML 2.0, and SCIM provisioning to enforce conditional access policy across SASE/SSE platforms.
• Deploy and tune Cloud Access Security Broker and Data Loss Prevention policy in inline and API-based modes under established policy guidelines.
• Execute platform health checks, policy tuning, and day-2 operational tasks across assigned SASE/SSE platforms.
• Support SASE and SD-WAN convergence testing, validating policy consistency across direct internet access and backhauled traffic paths.
• Contribute platform-specific input to client Zero Trust maturity roadmaps under the direction of the engagement lead.

Skills

Client-facing experience

Zero Trust concepts

Network security basics

Documentation skills

Education

Bachelor's degree in CS/Engineering

Tools

Zscaler (ZIA/ZPA)

Palo Alto Prisma Access

Cisco Secure Access

Netskope Security Cloud

Okta / Entra ID integration

SAML 2.0 / SCIM

Job description

AHEAD seeks a Technical Consultant to deliver SASE and SSE engagements for enterprise clients in the United States. The role covers configuring and operating Zero Trust architectures across four core platforms and leading remote and on-site deployment workstreams, following a design from a Senior or Principal Consultant.

You will own hands-on configuration, testing, and knowledge transfer for assigned workstreams, contribute to client-facing documentation, and mentor junior engineers while