Zero Trust Architect; Expert
Listed on 2026-09-04
-
IT/Tech
Cybersecurity, Systems Engineer, Cloud Computing: Infrastructure & Operations, Network Security
Senior Zero Trust Architect
Herndon, VA Top Secret/SCI Polygraph Unspecified Career Level not specified $146,670 - $249,330
Job DescriptionBAE Systems, a top-ten prime contractor to the U.S. Department of Defense, enables the U.S. government to transform data into intelligence and provides engineering, integration and sustainment support for critical military platforms and systems. Intelligence & Security provides services and products to the Department of Defense, the government, federal law enforcement officials, and troops deployed around the world. At BAE Systems, we promote a strong, collaborative culture and provide our employees with the tools, skills and training they need to succeed.
We are all about trust, camaraderie, and a shared ambition to lead the world in defense technologies and national security services. We offer flexible work environment to support the balance in your life and keep you performing at your best. Be a part of a company that is part of the community; driven to improve our future and protect our freedom.
We are seeking a Senior Zero Trust Architect to design, implement, and operate our Secure Service Edge (SSE) and Zero Trust security architecture. This role sits at the intersection of networking, identity, and cloud security, and is responsible for building secure, scalable access models across hybrid and cloud-first environments. The ideal candidate brings deep hands-on expertise across SSE platforms, Microsoft 365/Azure security, identity and access management, and network traffic engineering, with the judgment to troubleshoot complex issues and the communication skills to align technical and business stakeholders.
Ability to communicate complex concepts to engineers, leadership, and non-technical stakeholders
Experience working in Agile or Dev Ops environments
Strong collaboration across security, networking, cloud, and endpoint teams
Ability to lead or contribute to architecture decision-making
Ability to design secure hybrid and cloud-first architectures
Experience evaluating SSE vendors based on performance, security, integration, and cost
Strong documentation skills:
Architecture diagrams
Runbooks
SOPs
Experience supporting PoCs and pilot deployments
ABC Required Education, Experience, & Skills We are looking for Systems Engineer with a minimum of 11 years' relevant experience and a Bachelors' Degree. Candidate must have experience in the following:
Experience in regulated environments (FedRAMP, DoD, GCC/GCCH/DoD tenants)
Certifications:
Microsoft (AZ-500, SC-300, SC-200)
Zscaler (ZCCA, ZCSP)
Cloudflare Zero Trust
CISSP, CCSP, CCNP Security
Exposure to:
Endpoint posture enforcement (Intune, Defender for Endpoint)
Browser isolation technologies
API security and SaaS governance
Preferred Education, Experience, & Skills Desired Skills Include:
Microsoft Entra (Azure AD), including Conditional Access, Identity Protection, and PIM
Microsoft Global Secure Access (GSA) or similar SSE-native integrations
Microsoft Defender Suite (Defender for Cloud Apps, Endpoint, Identity, Office)
Experience integrating third-party SSE platforms with M365 workloads:
Exchange Online, SharePoint Online, Teams, One Drive
Understanding of Azure networking constructs: VNets, NSGs, Private Endpoints, Virtual WAN
Familiarity with Azure Firewall, Application Gateway/WAF, and private access models
TCP/IP, DNS, HTTP/S, TLS inspection, proxy architectures
Routing (BGP), NAT, VPN (IPSec/SSL), SD-WAN integrations
Experience with traffic steering methods: PAC files, GRE/IPSec tunnels, agent-based forwarding
Understanding of secure internet breakout and branch connectivity models
Ability to troubleshoot latency, packet loss, and SaaS performance issues in cloud-delivered security pipelines
Z scaler: ZIA/ZPA design, policy implementation, app segmentation
Microsoft Global Secure Access (Entra):
Private & Internet Access, Conditional Access integration
Cloudflare One: SWG, Zero Trust Access, WARP client, DNS filtering
Akamai EAA:
Secure application publishing, identity integration, traffic optimization
Pay Information Full-Time Salary Range: $146670 - $249330
Please note:
This range is based on our market pay structures.…
(If this job is in fact in your jurisdiction, then you may be using a Proxy or VPN to access this site, and to progress further, you should change your connectivity to another mobile device or PC).