Technical Consultant - Network Security SASE

Remote; San Francisco (CA); Hybrid; USD 140,000 - 180,000; Full time

Job summary

AHEAD is seeking a Technical Consultant to deliver SASE and SSE engagements for enterprise clients. You will independently lead remote and on-site deployment workstreams across Zscaler, Palo Alto Prisma Access, Cisco Secure Access, and Netskope, configuring Zero Trust architectures and providing knowledge transfer to client teams.

Responsibilities include hands-on configuration, testing, documentation, and mentoring junior engineers, with opportunities for advancement to Senior Technical

Qualifications

• 3 to 5 years in network security or security engineering
• Production experience with at least one SASE/SSE platform
• Understanding of Zero Trust architectures and related concepts
• Experience with identity providers (Okta, Entra ID), SAML 2.0, SCIM
• Knowledge of routing protocols and traffic forwarding designs
• Ability to produce client-facing documentation
• Willingness to travel 25%

Responsibilities

• Lead remote and on-site SASE/SSE deployment workstreams per established design.
• Configure and validate ZIA, ZPA, Prisma Access, Cisco Secure Access, and Netskope platforms.
• Implement identity-based access controls and policy enforcement.
• Produce design and as-built documentation; mentor junior engineers.
• Perform platform health checks and day-2 operations tasks.
• Contribute to project milestones and risk/ scope management.

Skills

3-5 years experience in network sec

SASE/SSE platforms experience

Zero Trust concepts

Identity management integration

Routing & connectivity basics

Documentation skills

Travel willingness 25%

Tools

Zscaler ZIA/ZPA

Palo Alto Prisma Access

Cisco Secure Access

Netskope Security Cloud

Job description

AHEAD builds platforms for digital business. By weaving together advances in cloud infrastructure, automation and analytics, and software delivery, we help enterprises deliver on the promise of digital transformation.

At AHEAD, we prioritize creating a culture of belonging, where all perspectives and voices are represented, valued, respected, and heard. We create spaces to empower everyone to speak up, make change, and drive the culture at AHEAD.

We are an equal opportunity employer, and do not discriminate based on an individual's race, national origin, color, gender, gender identity, gender expression, sexual orientation, religion, age, disability, marital status, or any other protected characteristic under applicable law, whether actual or perceived.

We embrace all candidates that will contribute to the diversification and enrichment of ideas and perspectives at AHEAD.

We are seeking a Technical Consultant to deliver Secure Access Service Edge (SASE) and Security Service Edge (SSE) engagements for enterprise clients. This role covers a single technology pillar spanning four core platforms: Zscaler Internet Access and Private Access, Palo Alto Networks Prisma Access, Cisco Secure Access, and Netskope Security Cloud. Technical Consultants independently lead remote and on-site SASE/SSE deployment workstreams, configuring and operating Zero Trust architectures against a design produced by a Senior Technical Consultant or Principal Technical Consultant. This role owns hands-on configuration, testing, and knowledge transfer for assigned workstreams, contributes to client-facing documentation, and mentors junior engineers, while building deep expertise in one SASE/SSE platform as the foundation for advancement to Senior Technical Consultant.

Key Responsibilities - SASE & Zero Trust:

• Configure and deploy Zscaler Internet Access (ZIA) components including Secure Web Gateway policy, SSL inspection, URL filtering, cloud firewall rules, and sandbox policy against an established design.

• Configure and deploy Zscaler Private Access (ZPA) application segments, App Connectors, and browser-based access for Zero Trust remote access.

• Configure Palo Alto Prisma Access GlobalProtect remote user connectivity, explicit proxy setup for branch offices, and service connections to on-premises infrastructure through Strata Cloud Manager or Panorama.

• Configure Cisco Secure Access Zero Trust Network Access, Secure Web Gateway, Cloud Access Security Broker, and resource connector deployment for private application access.

• Configure Netskope Security Cloud Next Gen SWG, CASB (API-enabled and inline), and Netskope Private Access traffic steering and policy enforcement.

• Implement traffic forwarding methods including GRE tunnels, IPsec tunnels, PAC files, and client connectors according to the design provided by the engagement architect.

• Configure identity-based access controls integrating with Okta, Microsoft Entra ID, SAML 2.0, and SCIM provisioning to enforce conditional access policy across SASE/SSE platforms.

• Deploy and tune Cloud Access Security Broker and Data Loss Prevention policy in inline and API-based modes under established policy guidelines.

• Execute platform health checks, policy tuning, and day-2 operational tasks across assigned SASE/SSE platforms.

• Support SASE and SD-WAN convergence testing, validating policy consistency across direct internet access and backhauled traffic paths.

• Contribute platform-specific input to client Zero Trust maturity roadmaps under the direction of the engagement lead.

Architecture, Delivery & Documentation:

• Participate in client-facing discovery sessions and design workshops, gathering requirements and validating current-state configuration for SASE/SSE scope.

• Contribute to High-Level Design and Low-Level Design documentation, network diagrams, and as-built documentation for assigned SASE/SSE workstreams.

• Execute migration and cutover tasks according to documented runbooks, rollback procedures, and change management workflows.

• Support knowledge transfer sessions, training client operations teams on day-2 SASE/SSE platform administration.

• Track assigned workstream milestones and escalation risks or scope changes to the project lead or Senior Technical Consultant.

• Identify client requests that fall outside the documented scope and escalation to the project manager or engagement lead before delivery impact occurs.

Practice Contribution:

• Mentor Associate and Senior Associate Technical Consultants on SASE/SSE platform fundamentals and troubleshooting techniques.

• Contribute to reusable delivery assets including configuration checklists, runbook templates, and knowledge base articles for the SASE/SSE practice.

• Pursue certification progression toward professional-level SASE/SSE credentials in the platform of primary focus.

• Support sales campaigns by validating technical scope and providing delivery continuity input to the account team, under the direction of the engagement Solutions Lead.

Required Qualifications:

• 3 to 5 years of network security, infrastructure security, or security engineering experience, including client-facing or internal project delivery experience.

• Production experience configuring at least one of the following SASE/SSE platforms: Zscaler (ZIA and ZPA), Palo Alto Prisma Access, Cisco Secure Access, or Netskope Security Cloud.

• Working knowledge of Zero Trust architecture principles, Secure Web Gateway, CASB, and ZTNA concepts across the broader SASE/SSE platform landscape.

• Understanding of identity and access management integration (Okta, Microsoft Entra ID, SAML 2.0, SCIM) with SASE/SSE policy enforcement.

• Familiarity with routing and connectivity fundamentals (BGP, OSPF, IPsec, GRE) sufficient to implement traffic forwarding designs provided by an architect.

• Ability to produce clear technical documentation and communicate configuration status and issues to both technical and non-technical stakeholders.

• Ability to travel at least 25 percent.

Preferred Qualifications:

• Zscaler Digital Transformation Administrator (ZDTA); Palo Alto Networks Security Service Edge (SSE) Engineer certification; Cisco Certified Specialist – Secure Cloud Access; Netskope Certified Cloud Security Administrator (NCCSA).

• CompTIA Security+, CCNA, or equivalent foundational networking or security certification.

• Production experience with a second SASE/SSE platform beyond the primary area of focus.

• Exposure to CASB and DLP policy tuning in inline or API-based deployment modes.

• Prior consulting, professional services, or managed services experience.

• Experience with cloud platforms (AWS VPC, Azure VNet) sufficient to support hybrid SASE/SSE connectivity designs.

Expectations:

• Independently leads remote and on-site SASE/SSE deployment workstreams within an established design.

• Operates with limited supervision on moderately complex configuration and troubleshooting tasks.

• Builds deep expertise in one SASE/SSE platform as the primary specialty, with working knowledge across the broader practice.

• Mentors junior engineers and contributes to SASE/SSE practice enablement content.

• Clearly articulates the scope of assigned work and how it supports the engagement's business objectives.

• Proactively raises schedule or scope concerns to the project lead or Senior Technical Consultant.

• Identifies out-of-scope client requests and escalates before delivery impact occurs.

• Carries a 70 percent target utilization.

Soft Skills:

• Clear written and verbal communication skills, with the ability to produce client-ready configuration and status documentation.

• Ability to manage assigned workstream timelines and communicate progress within a consulting delivery model.

• Self-directed and detail-oriented, comfortable operating on-site at client facilities or in a remote delivery capacity.

• Collaborative approach to working with senior engineers, project leads, and cross-functional delivery teams.

• Receptive to mentorship and structured skill development, with an active interest in advancing technical depth.

Why AHEAD:

Through our daily work and internal groups like Moving Women AHEAD and RISE AHEAD, we value and benefit from