Zero Trust Architect (Expert)

About the role

The Senior Zero Trust Architect role at BAE Systems is located at the intersection of networking, identity, and cloud security. This role is responsible for designing, implementing, and operating the Secure Service Edge (SSE) and Zero Trust security architecture.

Responsibilities

• Design and implement secure, scalable access models across hybrid and cloud-first environments.
• Work with security, networking, cloud, and endpoint teams to lead or contribute to architecture decisions.
• Support PoCs and pilot deployments of SSE platforms, Microsoft 365/Azure security, identity and access management, and network traffic engineering.
• Communicate complex concepts to engineers, leadership, and non-technical stakeholders.

Requirements

• Minimum 11 years of relevant experience and a Bachelor's Degree.
• Experience in regulated environments (FedRAMP, DoD, GCC/GCCH/DoD tenants).
• Microsoft (AZ-500, SC-300, SC-200) certifications.
• Zscaler (ZCCA, ZCSP) certifications.
• Cloudflare Zero Trust certifications.
• Certifications: CISSP, CCSP, CCNP Security.
• Exposure to: Endpoint posture enforcement (Intune, Defender for Endpoint), Browser isolation technologies, API security and SaaS governance.

Qualifications

• Experience in SSE platforms, Microsoft 365/Azure security, identity and access management, and network traffic engineering.
• Ability to troubleshoot complex issues and communicate with technical and business stakeholders.
• Strong documentation skills: Architecture diagrams, runbooks, SOPs.

Skills

• Experience in Microsoft Entra ID (Azure AD), including Conditional Access, Identity Protection, and PIM.
• Experience in Microsoft Global Secure Access (GSA) or similar SSE-native integrations.
• Experience in Microsoft Defender Suite (Defender for Cloud Apps, Endpoint, Identity, Office).
• Experience integrating third-party SSE platforms with M365 workloads: Exchange Online, SharePoint Online, Teams, OneDrive.
• Understanding of Azure networking constructs: VNets, NSGs, Private Endpoints, Virtual WAN.
• Familiarity with Azure Firewall, Application Gateway/WAF, and private access models.
• Experience with TCP/IP, DNS, HTTP/S, TLS inspection, proxy architectures, Routing (BGP), NAT, VPN (IPSec/SSL), SD-WAN integrations.
• Experience with traffic steering methods: PAC files, GRE/IPSec tunnels, agent-based forwarding.
• Understanding of secure internet breakout and branch connectivity models.
• Experience troubleshooting latency, packet loss, and SaaS performance issues in cloud-delivered security pipelines.
• Experience with Zscaler: ZIA/ZPA design, policy implementation, app segmentation.
• Experience with Microsoft Global Secure Access (Entra): Private & Internet Access, Conditional Access integration.
• Experience with Cloudflare One: SWG, Zero Trust Access, WARP client, DNS filtering.
• Experience with Akamai EAA: Secure application publishing, identity integration, traffic optimization.

Pay

Full-Time Salary Range: $146670 - $249330. Individual salaries are determined by a variety of factors including, but not limited to: business considerations, local market conditions, and internal equity, as well as candidate qualifications, such as skills, education, and experience.

Benefits

• Health, dental, and vision insurance.
• Health savings account.
• A 401(k) savings plan.
• Disability coverage.
• Life and accident insurance.
• Employee Assistance Program.
• Legal plan.
• Discounts on home, auto, and pet insurance.
• Paid time off, paid holidays, and other types of leave.
• Recognition program for monetary and non-monetary recognition awards.
• Other incentives based on position level and/or job specifics.