Tenant Separation & Build-Out Build and configure a new Zscaler tenant (ZIA and ZPA) as a full net-new deployment for the retained entity Configure ZIA internet security policies (URL filtering, threat protection, DLP, SSL inspection, cloud firewall) Configure ZPA access policies, forwarding policies, inspection policies, and isolation policies Deploy ZPA App Connectors in retained-entity network segments and validate connectivity Establish GRE tunnels from PoP internet routers to the new ZIA cloud instance Configure Zscaler Digital Experience (ZDX) monitoring
Identity Integration Configure SAML/OIDC federation between the new Zscaler tenant and the shared identity provider (e.g. Okta) Implement attribute-based user routing to ensure users are directed to the correct tenant Coordinate with the identity team on group/attribute configuration for entity classification Validate that users without valid entity classification are denied access to both tenants
Separacy Enforcement Implement and validate bidirectional separacy controls - ensuring neither entity's users can access the other's private applications without explicit authorisation Configure automated policy audit mechanisms to detect and alert on separacy violations Support Day 1 readiness testing including cross-tenant access validation
Transitional Cross-Tenant Access Configure Multi-ZPA Tenant Access for explicitly agreed shared services during the transitional period Maintain cross-tenant access policies aligned to the transitional services schedule Conduct periodic access reviews and revoke access for services that have completed transition
Divested Tenant Cleanup Remove retained-entity users, policies, application segments, and App Connectors from the divested tenant Reconfigure RBAC and administrative access on the divested tenant for the divested entity's operations team Support devolved policy management models for divested teams using IaC/CICD
Transitional Service Operations & Exit Provide administration of the divested tenant during the transitional period (platform management, connector management, tunnel management) Produce periodic service reports covering availability and incident metrics Support handover including admin transfer, IdP migration, and cross-tenant policy removal
Reporting & Analytics Configure independent cyber reporting (e.g. Zscaler 360i) for each tenant Ensure no cross-entity data leakage in reporting and analytics dashboards
Collaboration & Delivery Work with Zscaler Professional Services on tenant provisioning and configuration Coordinate with the core routing team on GRE tunnel and internet edge integration Collaborate with the workplace team on Client Connector deployment and MDM integration Participate in design assurance reviews and produce technical documentation
---
Required Skills & Experience
Zscaler Platform Deep hands-on experience administering Zscaler ZIA (URL filtering, threat protection, DLP, SSL inspection, cloud firewall rules) Deep hands-on experience administering Zscaler ZPA (access policies, App Connectors, application segments, segment groups, server groups) Experience with Zscaler Client Connector deployment and configuration Understanding of Zscaler GRE/IPSec tunnel integration for non-Client Connector traffic Familiarity with Zscaler Digital Experience (ZDX) monitoring Experience with multi-tenant or divestiture scenarios in Zscaler
Identity & Access Strong understanding of SAML/OIDC federation and identity provider integration Experience with Okta or equivalent enterprise identity provider Understanding of attribute-based access control and user routing Familiarity with SCIM provisioning for user/group synchronisation
Infrastructure as Code Experience managing Zscaler configuration via Terraform (Zscaler Terraform provider) Familiarity with CICD pipelines for policy deployment (GitHub Actions or equivalent) Understanding of GitOps practices for configuration management
Security & Policy Design Strong understanding of zero trust network access (ZTNA) principles Experience designing internet security policies (web filtering, threat prevention, DLP) Understanding of SSL inspection, certificate management, and bypass policies Familiarity with cloud firewall rule design and traffic forwarding policies
VPN & Legacy Remote Access Understanding of traditional VPN technologies (Cisco ASA, AnyConnect) and how they relate to/migrate towards ZTNA Experience with VPN separation or decommissioning as part of Zscaler adoption programmes Familiarity with split-tunnel vs full-tunnel architectures and coexistence with Zscaler Client Connector
Identity & Access Control Familiarity with Cisco ISE or equivalent NAC platforms - understanding of how Zscaler integrates with broader identity and access control ecosystems Understanding of TACACS+/RADIUS in the context of network device authentication alongside ZTNA
Cloud Security Integration Understanding of cloud security architecture in AWS, Azure, and/or GCP (VPC security groups, NSGs, cloud firewalls) Familiarity with deploying Zscaler App Connectors and Private Service Edges in cloud environments Experience with securing hybrid connectivity (Direct Connect, ExpressRoute, GRE/IPSec tunnels) through Zscaler
Automation, DevOps & Tooling Daily use of Git and GitHub (branching, pull requests, code review workflows) Working knowledge of Python - able to read, run, and contribute to automation codebases (e.g. Zscaler SDK scripts, policy validation) Experience with Terraform for Zscaler configuration management (Zscaler Terraform provider - consuming and contributing to modules) Ability to consume and operate CI/CD-driven policy deployment pipelines built by the automation team Comfortable working with structured data formats (JSON, YAML, HCL) used in automation templates
General Understanding of network fundamentals (routing, DNS, IP addressing) sufficient to configure tunnel integrations Experience with change management and controlled policy rollout Ability to produce clear technical documentation and runbooks
