Zero Trust Future-State Architect STA (Expert)

About the role

This position is onsite in McLean, VA. Approximately 60% of the role is technical (architecture, engineering guidance, gap analysis, and solution design); the remaining 40% is communications, coordination, and facilitation.

• Serve as the senior technical advisor and implementation lead supporting the CIO’s Zero Trust program.
• Serve as a technical advisor to the Government Zero Trust Program Manager on adoption strategies, roadmaps, prioritization, and policy integration.
• Provide expertise in the design, integration, and implementation of Zero Trust principles across a large, complex enterprise IT environment while ensuring compliance with DoD, IC, and federal cybersecurity mandates.
• Provide expert guidance on integration of Zero Trust capabilities into enterprise networks, multi-cloud, hybrid environments, and DevSecOps pipelines (ICAM, micro-segmentation, encryption, continuous monitoring, software-defined perimeters, etc.).
• Drive progress across multiple CIO divisions that do not report to the Zero Trust program and often have competing priorities.
• Drive agency-level Zero Trust compliance activities, including maturity assessments, gap analyses, and prioritized remediation planning.
• Develop and refine detailed Zero Trust reference architectures and system designs across all Zero Trust pillars.
• Facilitate cross-divisional coordination within the CIO organization; navigate conflicting priorities and stakeholder resistance without formal authority.
• Analyze and prioritize adjacent taskings (for example, tool investments or initiatives from other CIO divisions) for alignment with Zero Trust objectives.
• Support limited liaison with GDIP claimants and partners on Zero Trust products and services.
• Support the design and improvement of enterprise services that can serve as common control providers, reducing the burden on individual system owners seeking RMF ATOs.
• Maintain accurate documentation of the current (as-is) architecture while developing a more detailed, executable to-be architecture; continuously identify and close gaps between the two.
• Conduct technical assessments across identity, device, network, application, and data layers.
• Contribute to the creation of reusable Zero Trust products and guidance that GDIP claimants and mission partners can consume.
• Collaborate with senior leadership, acquisition teams, engineers, system owners, and mission stakeholders to integrate Zero Trust into enterprise workflows.
• Respond to data calls, develop executive-level reports and briefings, and serve as a technical liaison ensuring alignment across technical, programmatic, and strategic stakeholders.

Requirements

Minimum Required Qualifications

• Active/current Top Secret security clearance with SCI eligibility; must be able to obtain and maintain a CI polygraph.
• Master’s degree in a related field and 12 years of experience, with at least 5 years dedicated to Zero Trust architecture, enterprise security design, and systems integration.
• One of the following IAT III certifications in compliance with DoD 8570.01-M and DoD Directive 8140 (e.g., CASP+ CE, CCNP Security, CISA, CISSP or Associate, GCED, GCIH, CCSP).
• Ability to operate effectively without direct authority, build coalitions, and translate strategy into executable action.
• In-depth knowledge of Zero Trust principles, enterprise security architecture, and federal cybersecurity frameworks (NIST SP 800-207, DoD Zero Trust Strategy, RMF, etc.).
• Strong understanding of large, siloed government CIO organizations and the practical challenges of implementing enterprise change without direct authority.
• Demonstrated experience architecting and deploying ZT solutions in large-scale or government environments.
• Expertise in cloud security (AWS, Azure, GCP), network segmentation, endpoint protection, and hybrid IT.
• Familiarity with RMF (NIST SP 800-37, SP 800-53) and DIA/DoD accreditation processes.
• Ability to facilitate technical and non-technical discussions, build consensus, and drive progress among stakeholders with competing priorities.
• Strong technical writing, briefing, and communication skills for both executive and engineering audiences.
• Ability to analyze complex enterprise systems, maintain concurrent as-is and to-be views, and translate strategy into actionable engineering and implementation steps.
• Ability to influence and coordinate across organizational boundaries without formal authority.
• Ability to manage competing priorities, adapt in a dynamic environment, and remain effective when working with difficult or siloed stakeholders.
• Ability to anticipate and mitigate risks while maintaining a resilient cybersecurity posture.
• Ability to analyze data and use metrics to drive decisions.

Desired Qualifications

• Active Top Secret security clearance with SCI eligibility and current CI polygraph.
• Master’s degree in Cybersecurity, Computer Science, Systems Engineering, or related discipline.
• Zero Trust vendor certifications (Palo Alto ZTNA, Microsoft SC-300/SC-100, Okta, AWS Security Specialty, Kubernetes Security).
• Comfort operating in ambiguous environments and wearing both architecture and implementation-herder / program-coordination hats.
• Ability to work effectively under pressure and meet tight deadlines.
• Ability to work in a team environment and possess a high degree of Emotional Intelligence.

Pay

Salary range estimate: $231,385 – $262,937. This represents the typical salary range for this position and is one component of Pueo’s total compensation package. Other rewards may include annual bonuses, short- and long-term incentives, and program-specific awards.

Benefits

Pueo provides a variety of benefits to employees.

About Pueo

Pueo is a National Security cyber company built to inspect, defend, harden, and continuously authorize the networks our customers depend on. We deliver mission-grade cybersecurity across defense, intelligence, homeland security, federal enterprise, and critical infrastructure. Our work connects mission-risk inspection, defensive cyber operations, continuous authorization, security engineering, and mission delivery through one accountable team.