Zero Trust Network Access Architect/Engineer - Quantico, VA - Secret Clearance Information Technology

SOC LLC; Quantico (VA); Hybrid; USD 116,000 - 165,000; Full time

Job summary

SOC LLC is seeking a Senior Zero Trust Network Architect/Engineer in Quantico, VA,Hybrid work arrangement with on-site presence. You will serve as the chief technical authority for ZTNA and SASE design, governance, and long-term security boundaries across cloud, on-prem, and mobile endpoints.

Responsibilities include defining roadmaps and reference architectures, leading the deployment of GlobalProtect and Versa SASE, and integrating with IAM (Okta/Azure AD) for continuous authentication.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Engineering, Information Systems Management, or related field; Master's or equivalent military service plus 12+ years acceptable.
• Minimum 10 years in network security engineering, enterprise architecture, and infrastructure security.
• At least 3–4 years architecting Zero Trust (NIST SP 800-207) and SASE in enterprise or federal environments.
• Advanced knowledge of Palo Alto Networks with Panorama and GlobalProtect deployments.
• Deep experience with Versa Networks SASE (SD-WAN, SWG, CASB, FBaaS).
• Must meet 8140 cert requirements (e.g., CISM, CISSP-ISSAP, CISSP-ISSEP, GCIA, GDSA, GICSP)

Responsibilities

• Act as Principal Architect for the DCSA Zero Trust journey, defining roadmap, reference architectures, and engineering guidelines per NIST SP 800-207.
• Lead design, implementation, and optimization of Palo Alto GlobalProtect and Versa SASE for cloud, hybrid, and mobile endpoints.
• Define and govern security policy templates in Palo Alto Panorama to enforce micro-segmentation and threat prevention.
• Architect DLP, SSL/TLS decryption, and threat prevention across all ingress/egress points.
• Conduct architectural reviews of SASE/ZTNA configurations to identify bottlenecks and mitigate gaps.
• Collaborate with IAM to integrate ZTNA/SASE with Okta, Azure AD; evaluate device posture and continuous authentication.
• Guide integration of Versa SASE and Palo Alto with SOC environments (SIEM, SOAR, EDR/XDR).
• Provide tier-4 engineering leadership for complex architectural and access control challenges.

Skills

ZTNA

SASE

Security architecture

Threat prevention

Education

Bachelor's Degree in Cybersecurity

Master's degree or equivalent experience

Tools

Palo Alto Panorama

GlobalProtect

Versa SASE

SIEM

SOAR

EDR

XDR

Job description

Senior Zero Trust Network Architect / Engineer needed for a direct hire opportunity with SOC's client to work on a hybrid basis in Quantico, VA.

Active Secret Clearance REQUIRED

* must be eligible to be upgraded to TS/SCI.*

Onsite at least two days a week or as needed at Quantico VA.

Summary

Seeking an industry-leading cybersecurity expert with a deep specialization in Zero Trust Network Architecture (ZTNA) and Secure Access Service Edge (SASE). The successful candidate will serve as the chief technical authority for the design, orchestration, implementation, and long-term governance of our enterprise security boundaries.

Responsibilities

• Serve as the Principal Architect for the DCSA Zero Trust journey, establishing the technical roadmap, reference architectures, and engineering guidelines aligned with NIST SP 800-207 standards.
• Lead the end-to-end design, implementation, and optimization of Palo Alto GlobalProtect and Versa Networks SASE to secure cloud, hybrid on-premises, and mobile endpoints.
• Define and govern global security policy templates within Palo Alto Panorama to enforce micro-segmentation, application-level security, and threat prevention.
• Architect advanced data loss prevention (DLP), SSL/TLS decryption, and threat prevention strategies across all egress and ingress points.
• Conduct regular architectural reviews of the SASE and ZTNA configurations to identify performance bottlenecks, configuration drifts, or security gaps, providing advanced mitigation strategies.
• Collaborate with Identity and Access Management (IAM) teams to integrate ZTNA/SASE policies with identity providers (e.g., Okta, Azure AD), ensuring device posture, user context, and continuous authentication are evaluated in real time.
• Guide the integration of Versa SASE and Palo Alto platforms with existing Security Operations Center (SOC) environments, including SIEM, SOAR, and endpoint detection (EDR/XDR) tools.
• Provide technical leadership and guidance to the cybersecurity engineering team, serving as the tier-4 escalations point for complex architectural, routing, and access control challenges.
• Author enterprise-level high-level designs (HLD), low-level designs (LLD), system security plans (SSP), and change-management policies for executive-level and government stakeholders.
• Stay abreast of the latest Palo Alto PAN-OS and Versa Networks feature sets, performing proof-of-concepts (PoC) to evaluate and deploy next-generation capabilities.
• Champion security-as-code and automation initiatives, using APIs and orchestration tools to automate secure connectivity and zero-touch deployments.

Qualifications

• Bachelor's Degree in Cybersecurity, Computer Engineering, Information Systems Management, or a related field. A Master's degree or an equivalent combination of military service and 12+ years of highly relevant experience is accepted.
• Minimum of 10 years of progressive experience in network security engineering, enterprise architecture, and infrastructure security.
• At least 3-4 years of direct experience architecting and implementing Zero Trust frameworks (NIST SP 800-207) and SASE solutions in enterprise or federal environments.
• Advanced architecture-level knowledge of Palo Alto Networks enterprise solutions, including deep management expertise via Panorama and secure access deployments using GlobalProtect.
• Deep technical proficiency in designing and deploying Versa Networks SASE (SD-WAN, Secure Web Gateway, Cloud Access Security Broker, and Firewall-as-a-Service).
• Must meet 8140 certification requirements (e.g. CISM, CISSP-ISSAP, CISSP-ISSEP, GCIA, GDSA, GICSP)

Desired Certifications

• Palo Alto Networks Certified Network Security Engineer (PCNSE)
• Palo Alto Networks Certified Zero Trust Network Security Engineer (PCZTNSE)
• Versa Certified SASE Professional (VCSP) or Versa Certified SASE Specialist (VCSS)

Employment Prerequisites

The following requirements must be met to be eligible for this position: successful completion of a background investigation and drug urinalysis.

SOC, a Day & Zimmermann company, is an Equal Opportunity Employer, EOE AA M/F/Vet/Disability.

Note: Any pay ranges displayed are estimations, which may have been provided by job boards. Actual pay is determined by an applicant's experience, technical expertise, and other qualifications as listed in the job description. All qualified applicants are welcome to apply.

Estimated Min Rate: $84.00

Estimated Max Rate: $120.00