Zscaler Security Engineer – London/Hybrid

Damia Group LTD

Zscaler Security Engineer – Remote/Hybrid – London – £550 – £625 per day INSIDE IR35

We are looking for an experienced Zscaler Security Engineer to join a major technology separation programme.

This is a hands-on contract role focused on building a new Zscaler environment for a retained business, migrating and separating security policies, and ensuring both organisations are operationally ready for Day 1.

You will take ownership of Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) engineering, working closely with Zscaler Professional Services and teams across identity, workplace technology, networking and programme delivery. The work includes tenant build-out, identity integration, transitional cross-tenant access, policy automation and handover.

Must be delivery background no one who comes from operational.

The role

• Build and configure a new Zscaler tenant across ZIA and ZPA.
• Design and implement Internet security, private access, forwarding, inspection and isolation policies.
• Deploy ZPA App Connectors and support GRE/IPSec tunnel integration with the Internet edge.
• Integrate Zscaler with an enterprise identity provider using SAML/OIDC, SCIM and attribute-based routing.
• Implement and test bidirectional separation controls, including approved transitional access to shared services.
• Automate configuration and policy deployment using Terraform, Git and CI/CD pipelines.
• Configure monitoring and reporting, including ZDX and independent tenant-level security reporting.
• Produce technical designs, runbooks and handover documentation, and support Day 1 readiness testing.

What we are looking for

• Deep, hands-on experience administering Zscaler ZIA and ZPA in complex enterprise environments.
• Strong knowledge of ZIA controls, including URL filtering, threat protection, DLP, SSL inspection and cloud Firewall.
• Strong knowledge of ZPA access policies, application segments, server groups and App Connectors.
• Experience integrating Zscaler with Okta or another enterprise identity provider.
• Experience with Zscaler Client Connector and GRE/IPSec tunnel connectivity.
• Practical Terraform experience, ideally using the Zscaler provider, plus Git-based CI/CD workflows.
• A sound understanding of zero trust, networking fundamentals, cloud security and controlled policy rollout.
• Clear technical documentation skills and the ability to collaborate across security, identity, workplace and network teams.

Desirable experience

• Delivery within a corporate divestiture, network separation or multi-tenant Zscaler programme.
• Zscaler Digital Experience, Zscaler 360i or policy-as-code validation.
• AWS, Azure or GCP security and hybrid connectivity.
• Cisco ASA, AnyConnect, ISE, TACACS+ or RADIUS.
• Zscaler, CCNP Security or equivalent professional certification.

Contract details

• Start: ASAP
• Duration: Initial 6 months, with potential to continue until July 2027
• Location: Remote/hybrid, as agreed
• Engagement: Contract via supplier
• Working model: Agile delivery in two-week sprints

Interested? Apply with an up-to-date CV highlighting your recent hands-on ZIA and ZPA delivery, identity integration and Terraform experience.

This temporary contract is inside IR35 and will require working under the direction of the client delivery manager as part of a multi-disciplinary team. The successful candidate will follow established delivery processes and working practices.

Damia Group Limited acts as an employment agency for permanent recruitment and employment business for the supply of temporary workers. By applying for this job you accept our Data Protection Policy which can be found on our website.

Please note that no terminology in this advert is intended to discriminate on the grounds of a person’s gender, marital status, race, religion, colour, age, disability or sexual orientation. Every candidate will be assessed only in accordance with their merits, qualifications and ability to perform the duties of the job.

Should the role require the successful candidate to undergo and be eligible for UK Security Vetting. Clearance sponsorship will be provided where required. Due to the nature of the work, candidates should meet the relevant residency requirements. If applicable, Reserved Post nationality restrictions will be confirmed by the client. Damia is committed to inclusive recruitment and welcomes applicants from all backgrounds.

Damia Group is acting as an Employment Business in relation to this vacancy and in accordance to Conduct Regulations 2003.