Zero Trust Architect (Expert)

</br><b>Job Description </b></br><p><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;">BAE Systems, a top-ten prime contractor to the U.S. Department of Defense, enables the U.S. government to transform data into intelligence and provides engineering, integration and sustainment support for critical military platforms and systems. Intelligence & Security provides services and products to the Department of Defense, the government, federal law enforcement officials, and troops deployed around the world.<br><br>At BAE Systems, we promote a strong, collaborative culture and provide our employees with the tools, skills and training they need to succeed. We are all about trust, camaraderie, and a shared ambition to lead the world in defense technologies and national security services. We offer flexible work environment to support the balance in your life and keep you performing at your best. Be a part of a company that is part of the community; driven to improve our future and protect our freedom.<br><span style="color:#262626">We are seeking a Senior Zero Trust Architect to design, implement, and operate our Secure Service Edge (SSE) and Zero Trust security architecture. This role sits at the intersection of networking, identity, and cloud security, and is responsible for building secure, scalable access models across hybrid and cloud-first environments. The ideal candidate brings deep hands-on expertise across SSE platforms, Microsoft 365/Azure security, identity and access management, and network traffic engineering, with the judgment to troubleshoot complex issues and the communication skills to align technical and business stakeholders.</span></span></span></p><ul style="margin-bottom:5px"><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Ability to communicate complex concepts to engineers, leadership, and non-technical stakeholders</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Experience working in Agile or DevOps environments</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Strong collaboration across security, networking, cloud, and endpoint teams</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Ability to lead or contribute to architecture decision-making</span></span></span></li><li style="margin-bottom:5px"><span style="color: rgb(38, 38, 38); font-family: Arial, Helvetica, sans-serif; font-size: 12px;">Ability to design secure hybrid and cloud-first architectures</span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Experience evaluating SSE vendors based on performance, security, integration, and cost</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Strong documentation skills:</span></span></span></li><li style="list-style-type:none"><ul><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Architecture diagrams</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Runbooks</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">SOPs</span></span></span></li></ul></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Experience supporting PoCs and pilot deployments</span></span></span></li></ul><p><br><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;">ABC</span></span></p></br></br><b>Required Education, Experience, & Skills </b></br><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;">We are looking for Systems Engineer with a minimum of 11 years' relevant experience and a Bachelors' Degree. Candidate must have experience in the following:</span></span><p><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;">Experience in the following are required:</span></span></p><ul><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Experience in regulated environments (FedRAMP, DoD, GCC/GCCH/DoD tenants)</span></span></span></li><li><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Certifications:</span></span></span></li><li style="list-style-type:none"><ul><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Microsoft (AZ-500, SC-300, SC-200)</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Zscaler (ZCCA, ZCSP)</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Cloudflare Zero Trust</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">CISSP, CCSP, CCNP Security</span></span></span></li></ul></li><li><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Exposure to:</span></span></span></li><li style="list-style-type:none"><ul><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Endpoint posture enforcement (Intune, Defender for Endpoint)</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Browser isolation technologies</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:11pt"><span style="font-family:Arial,sans-serif"><span style="color:#262626"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;">API security and SaaS governance</span></span></span></span></span></li></ul></li></ul></br></br><b>Preferred Education, Experience, & Skills </b></br><p><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;">Desired Skills Include:</span></span></p><ul><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Microsoft Entra ID (Azure AD), including Conditional Access, Identity Protection, and PIM</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Microsoft Global Secure Access (GSA) or similar SSE-native integrations</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Microsoft Defender Suite (Defender for Cloud Apps, Endpoint, Identity, Office)</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Experience integrating third-party SSE platforms with M365 workloads: Exchange Online, SharePoint Online, Teams, OneDrive</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Understanding of Azure networking constructs: VNets, NSGs, Private Endpoints, Virtual WAN</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Familiarity with Azure Firewall, Application Gateway/WAF, and private access models</span></span></span></li><li style="margin-bottom:5px"><span style="color: rgb(38, 38, 38); font-family: Arial, Helvetica, sans-serif; font-size: 12px;">TCP/IP, DNS, HTTP/S, TLS inspection, proxy architectures</span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Routing (BGP), NAT, VPN (IPSec/SSL), SD-WAN integrations</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Experience with traffic steering methods: PAC files, GRE/IPSec tunnels, agent-based forwarding</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Understanding of secure internet breakout and branch connectivity models</span></span></span></li><li style="margin-bottom:5px"><span style="font-size:12px;"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="color:#262626">Ability to troubleshoot latency, packet loss, and SaaS performance issues in cloud-delivered security pipelines</span></span></span></li><li style="margin-bottom:5px"><span style="color: rgb(38, 38, 38);"><font face="Arial, sans-serif"><span style="font-size: 14.6667px;">Z</span></font><span style="font-family: Arial, Helvetica, sans-serif; font-size: 12px;">scaler: ZIA/ZPA design, policy implementation, app segmentation</span></span></li><li style="margin-bottom:5px"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="font-size:12px;"><span style="color:#262626">Microsoft Global Secure Access (Entra): Private & Internet Access, Conditional Access integration</span></span></span></li><li style="margin-bottom:5px"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="font-size:12px;"><span style="color:#262626">Cloudflare One: SWG, Zero Trust Access, WARP client, DNS filtering</span></span></span></li><li style="margin-bottom:5px"><span style="font-family:Arial,Helvetica,sans-serif;"><span style="font-size:12px;"><span style="color:#262626">Akamai EAA: Secure application publishing, identity integration, traffic optimization</span></span></span></li></ul><br><br><b>Pay Information</b><br>Full-Time Salary Range: $146670 - $249330<br><br>Please note: This range is based on our market pay structures. However, individual salaries are determined by a variety of factors including, but not limited to: business considerations, local market conditions, and internal equity, as well as candidate qualifications, such as skills, education, and experience. <br><br>Employee Benefits: At BAE Systems, we support our employees in all aspects of their life, including their health and financial well-being. Regular employees scheduled to work 20+ hours per week are offered: health, dental, and vision insurance; health savings accounts; a 401(k) savings plan; disability coverage; and life and accident insurance. We also have an employee assistance program, a legal plan, and other perks including discounts on things like home, auto, and pet insurance. Our leave programs include paid time off, paid holidays, as well as other types of leave, including paid parental, military, bereavement, and any applicable federal and state sick leave. Employees may participate in the company recognition program to receive monetary or non-monetary recognition awards. Other incentives may be available based on position level and/or job specifics.<br></br></br><b>About BAE Systems Intelligence & Security </b></br>BAE Systems, Inc. is the U.S. subsidiary of BAE Systems plc, an international defense, aerospace and security company which delivers a full range of products and services for air, land and naval forces, as well as advanced electronics, security, information technology solutions and customer support services. Improving the future and protecting lives is an ambitious mission, but it’s what we do at BAE Systems. Working here means using your passion and ingenuity where it counts – defending national security with breakthrough technology, superior products, and intelligence solutions. As you develop the latest technology and defend national security, you will continually hone your skills on a team—making a big impact on a global scale. At BAE Systems, you’ll find a rewarding career that truly makes a difference.<br><br>Intelligence & Security (I&S), based in McLean, Virginia, designs and delivers advanced defense, intelligence, and security solutions that support the important missions of our customers. Our pride and dedication shows in everything we do—from intelligence analysis, cyber operations and IT expertise to systems development, systems integration, and operations and maintenance services. Knowing that our work enables the U.S. military and government to recognize, manage and defeat threats inspires us to push ourselves and our technologies to new levels.<br><br>This position will be posted for at least 5 calendar days. The posting will remain active until the position is filled, or a qualified pool of candidates is identified.<br>