Zscaler Support Administrator

Job Summary

The Security Application Support (Zscaler Support Administrator) role ensures the secure implementation, configuration, and ongoing operational health of the MBTA's Secure Access Service Edge (SASE) environment and integrated security platforms. This position provides technical expertise across cloud security services, user access technologies, and threat prevention capabilities to protect MBTA systems, data, and users. The role supports both project-based initiatives and day-to-day operations, partnering closely with security engineering, infrastructure, and application teams to maintain resilient, compliant, and Zero Trust aligned security controls.

The scope of this role includes initial configuration, deployment, administration, monitoring, and continuous improvement of SASE components; integration with Microsoft cloud and endpoint protection technologies; troubleshooting of user and system issues; policy development and tuning; documentation of operational standards; and participation in threat intelligence and remediation activities. The position also contributes to security architecture enhancements, assists with cloud migration efforts, and advises on emerging security acquisitions to ensure alignment with MBTA Information Security policies, industry best practices, and regulatory requirements.

• Perform initial configuration and setup of the SASE cloud (Internet Access, Private Access, digital experience, SAML, add-ons, etc.).
• Assist with various implementation projects as they relate to Azure, Intune, Office 365, and application cloud migrations.
• Investigate and apply SASE best practices.
• Provide comprehensive administration and support of the Zscaler platform (ZIA, ZPA), including daily operational tasks, policy updates, SSL inspection management, certificate workflows, log analysis, troubleshooting, and coordination with Zscaler TAC.
• Perform day-to-day administration of the SASE.
• Document SASE standard operating procedures and protocols.
• Create SASE dashboards and reports to monitor and ensure SASE health.
• Coordinate and leverage threat intelligence to prevent and remediate vulnerabilities and threats.
• Receive and fulfill technical work assignments – Service Now and data calls.
• Fulfill policy requests to fine tune operations of the SASE Standards that align with Information Security Policies.
• Monitor, troubleshoot and resolve user experience issues and provide remediation recommendations.
• Assist other system and security engineers in optimizing policies and user configuration.
• Document issues and escalate to next tier or vendor support, as necessary.
• Monitor systems consoles and remediate alerts.
• Perform policy administration for web proxies, URL filtering, secure web gateway, CASB, and data loss prevention.
• Support integration with Microsoft products like Azure Active Directory and Microsoft Conditional Access Policies.
• Support integration with EDR products like Crowd Strike.
• Identify and recommend Security Architecture Improvements or solutions for review by leadership and continue to be a champion of Zero Trust maturity at the MBTA.
• Serve as an advisor on new security acquisitions.
• Perform all other duties and projects that may be assigned.

Additional responsibilities may include focus on one or more departments or locations. See applicable addendum for department or location specific functions.

Physical Demands and Working Conditions

• The physical demands and work environment characteristics described here are representative of those an employee encounters while performing the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.
• Available to work any and all shifts and/or locations as assigned or directed.
• Available to work as per assignment by the MBTA twenty-four (24) hours per day, seven (7) days per week as directed by supervisory staff for severe weather conditions, emergencies or any other circumstances that may potentially impact service or the safety of service.

Supervision

• No direct reports.

Minimum Education

• Bachelor's degree from an accredited institution.