Zero Trust Network Access Architect/Engineer

About the role

Amatriot is hiring a Zero Trust Network Access Architect/Engineer to support the Defense Counterintelligence and Security Agency (DCSA) program in Quantico, VA. This full‑time position serves as the chief technical authority for the design, orchestration, implementation, and long‑term governance of enterprise security boundaries, leading modernization of DCSA’s hybrid workforce infrastructure using Palo Alto Networks Panorama and GlobalProtect and Versa Networks SASE platforms to establish resilient, identity‑aware, context‑driven security.

Responsibilities

• Serve as Principal Architect for DCSA’s Zero Trust initiative, establishing technical roadmaps, reference architectures, and engineering guidelines aligned with NIST SP 800‑207.
• Lead the design, implementation, and optimization of Palo Alto GlobalProtect and Versa Networks SASE to secure cloud, hybrid on‑premises, and mobile endpoints.
• Define and govern global security policy templates in Palo Alto Panorama to enforce micro‑segmentation, application‑level security, and threat prevention.
• Architect data loss prevention (DLP), SSL/TLS decryption, and threat prevention strategies across all ingress and egress points.
• Review SASE and ZTNA architectures for performance bottlenecks, configuration drift, and security gaps, and develop advanced mitigation strategies.
• Collaborate with Identity and Access Management (IAM) teams to integrate ZTNA/SASE policies with identity providers such as Okta and Azure AD, ensuring real‑time evaluation of device posture, user context, and continuous authentication.
• Guide integration of Versa SASE and Palo Alto platforms with existing Security Operations Center (SOC) environments, including SIEM, SOAR, and EDR/XDR tools.
• Provide technical leadership and guidance to cybersecurity engineers, serving as the Tier 4 escalation point for complex architectural, routing, and access control challenges.
• Develop enterprise‑level high‑level designs (HLD), low‑level designs (LLD), system security plans (SSP), and change management policies for executive and government stakeholders.
• Track Palo Alto PAN‑OS and Versa Networks features and conduct proofs of concept (PoCs) to evaluate and deploy next‑generation capabilities.
• Lead security‑as‑code and automation initiatives using APIs and orchestration tools to automate secure connectivity and zero‑touch deployments.

Qualifications

• Education: Bachelor’s degree in Cybersecurity, Computer Engineering, Information Systems Management, or a related field. A master’s degree or an equivalent combination of military service and 12+ years of highly relevant experience is accepted.
• Experience: Minimum of 10 years of progressive experience in network security engineering, enterprise architecture, and infrastructure security. At least 3–4 years of direct experience architecting and implementing Zero Trust frameworks aligned with NIST SP 800‑207 and SASE solutions in enterprise or federal environments.
• Certifications: Meet 8140 certification requirements, with examples including CISM, CISSP‑ISSAP, CISSP‑ISSEP, GCIA, GDSA, and GICSP.

Skills

• Advanced architecture‑level knowledge of Palo Alto Networks enterprise solutions, including Panorama management and GlobalProtect secure access deployments.
• Deep technical proficiency in designing and deploying Versa Networks SASE, including SD‑WAN, Secure Web Gateway, Cloud Access Security Broker, and Firewall‑as‑a‑Service.
• Ability to communicate complex technical ideas to a diverse customer base verbally and in writing.

Requirements

• Active Secret clearance and eligibility for an upgrade to TS/SCI.
• Primarily a telework position, with a requirement to be onsite at least two (2) days a week or as needed at Quantico Marine Corps Base, VA. Additional onsite time may be required during initial onboarding and program integration. If the alternate worksite is outside DCSA facilities or corporate office space, reliable voice communication capability (cell phone preferred) and a stable, capable internet connection are required.

Pay

Target Salary Range: $190,000 - $220,000

Schedule

Hybrid: 2 days onsite per week (Quantico, VA). Additional onsite time may be required during onboarding and program integration.