Zero Trust Engineer Mid Level

CELESTIAL INNOVATIONS GROUP LLC; Washington (District of Columbia); On-site; USD 100,000 - 130,000; Full time

Benefits offered by this job

401(k)

Dental insurance

Health insurance

Paid time off

Training & development

Vision insurance

Job summary

CELESTIAL INNOVATIONS GROUP LLC is looking for a Mid Zero Trust Engineer in Washington to support the design and implementation of Zero Trust Architecture for federal clients. The ideal candidate will lead assessments, develop roadmaps, and translate federal mandates into actionable plans.

This role requires significant cybersecurity experience and proficiency in at least one key ZTA vendor platform. Flexible work-from-home options are available.

Qualifications

• 5+ years of experience in cybersecurity engineering, network security, or IT infrastructure roles.
• 2+ years of hands-on experience designing or implementing Zero Trust Architecture.
• Proficiency in cloud environments such as Azure, AWS, or hybrid architectures.

Responsibilities

• Lead Zero Trust Architecture assessments and roadmap development for federal clients.
• Design and implement ZTA solutions across various security pillars.
• Serve as a trusted advisor to federal agency stakeholders.

Skills

Cybersecurity engineering

Zero Trust Architecture

Network security

Identity and access management

Cloud environments

Education

Relevant degree in cybersecurity or IT

Tools

Palo Alto Prisma

Zscaler

Microsoft Zero Trust stack

Job description

Benefits:

• 401(k)
• Dental insurance
• Health insurance
• Paid time off
• Training & development
• Vision insurance

Position Summary:

Celestial Innovations Group (CIG) is seeking a Mid Zero Trust Engineer to support federal agency clients in the design, implementation, and sustainment of Zero Trust Architecture (ZTA) programs. This role is framework-agnostic and vendor-informed: the ideal candidate understands that Zero Trust is a security philosophy and architectural strategy, not a single product or platform. The engineer will apply that expertise across one or more leading vendor ecosystems to deliver compliant, mission-ready ZTA solutions aligned with federal mandates including EO 14028, OMB M-22-09, NIST SP 800-207, and the CISA Zero Trust Maturity Model.

Key Responsibilities:

Architecture and Strategy

• Lead Zero Trust Architecture assessments, gap analyses, and roadmap development for federal clients
• Design and document ZTA solutions spanning all five pillars: Identity, Device, Network, Application/Workload, and Data
• Translate federal ZTA mandates (EO 14028, OMB M-22-09, CISA ZT Maturity Model) into actionable implementation plans
• Develop architecture artifacts including conceptual, logical, and physical ZTA diagrams using DODAF, TOGAF, or equivalent frameworks
• Support integration of ZTA principles into existing enterprise architectures, hybrid cloud environments, and multi-tenant federal networks

Implementation and Engineering

• Deploy and configure Zero Trust solutions across one or more vendor platforms (see Vendor Ecosystem section below)
• Implement Identity and Access Management controls including CAC/PIV authentication, MFA, role-based access control (RBAC), and Just-in-Time (JIT) Privileged Access Management
• Configure microsegmentation, Zero Trust Network Access (ZTNA), software-defined perimeters, and DNS security controls
• Deploy Endpoint Detection and Response (EDR) tooling and enforce device compliance policies at enterprise scale
• Integrate data protection controls including classification, labeling, DLP, and encryption aligned to ZTA data pillar requirements

Compliance and Authorization

• Align ZTA implementations with NIST SP 800-53 Rev 5, NIST SP 800-207, DISA STIGs, and DHS CDM program requirements
• Support the Risk Management Framework (RMF) lifecycle, including SSP authoring, continuous monitoring, and ATO maintenance
• Document ZTA controls for system security packages, POA&M, and security assessment reports

Client Engagement and Collaboration

• Serve as a trusted ZTA advisor to federal agency stakeholders, program managers, and ISSO/ISSM counterparts
• Produce executive-level briefings, technical white papers, and implementation status reports
• Collaborate cross-functionally with cloud, networking, data analytics, and infrastructure teams to ensure cohesive ZTA integration

Vendor Ecosystem Experience

Vendor / Framework & Relevant Capabilities

Palo Alto Networks (Prisma): Prisma Access (ZTNA 2.0), Prisma Cloud, Cortex XDR/XSIAM, NGFW policy, SD-WAN integration, threat prevention across all ZTA pillars

Zscaler: Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), Zscaler Digital Experience (ZDX), cloud proxy architecture, VPN replacement, SSL inspection

Microsoft Zero Trust: Microsoft Entra ID (Azure AD), Conditional Access, Intune/MEM, Microsoft Defender suite, Sentinel SIEM/SOAR, Purview data governance, M365 compliance center

CISA ZT Maturity Model: Five-pillar maturity assessment (Traditional, Initial, Advanced, Optimal), cross-cutting capability mapping, agency self-assessment support, roadmap alignment to federal reporting requirements

Required Qualifications

Experience

• 5+ years of experience in cybersecurity engineering, network security, or IT infrastructure roles
• 2+ years of hands-on experience designing or implementing Zero Trust Architecture in an enterprise or federal environment
• Demonstrated understanding of ZTA concepts across all five pillars per NIST SP 800-207 and the CISA Zero Trust Maturity Model
• Experience supporting federal government clients or DoD/civilian agency environments

Technical Skills

• Proficiency in at least one of the following: Palo Alto Prisma, Zscaler, or Microsoft Zero Trust stack
• Identity and access management: Entra ID, Active Directory, LDAP, PKI, MFA, PAM tooling
• Network security: microsegmentation, ZTNA, DNS security, SD-WAN, next-generation firewall policy
• Endpoint security: EDR/XDR deployment and management, device compliance policy enforcement
• Cloud environments: Azure, AWS, or hybrid cloud architectures with ZTA overlay
• Familiarity with SIEM/SOAR platforms (Microsoft Sentinel, SumoLogic, Google SecOps, or equivalent)

Preferred Qualifications

• Active certifications in one or more ZTA vendor platforms: PCCSE, PCNSE, Zscaler ZCCA-IA or ZCCA-PA, Microsoft SC-100 (Cybersecurity Architect Expert)
• Additional certifications: CISSP, CISM, CompTIA Security+, Cloud+ or relevant AWS/Azure security certifications
• Familiarity with RMF processes: NIST SP 800-37, SSP authoring, ATO package preparation
• Experience with ServiceNow, Salesforce, or IT service management tooling in a federal context
• Multi-vendor ZTA integration experience (e.g., combining Palo Alto and Zscaler capabilities within a single architecture)
• Familiarity with post-quantum cryptography standards (FIPS 203/204/205) and their ZTA implications

Flexible work from home options available.