Zscaler Security Engineer

At L.L.Bean, we believe the outdoors brings out the best in all of us. We are committed to fostering a culture of belonging and creating safe, inclusive spaces where everyone feels welcome—both here and Outside. We value individual differences and are dedicated to maintaining an inclusive work environment where everyone can bring the best of their experience and talents and truly thrive.

L.L. Bean Inc. Freeport Maine is looking for a Zscaler Security Engineer to join our network team, someone passionate and with proven experience in networking, cloud-delivered security, and infrastructure automation. This role will be responsible for Zscaler services, engineering, supporting, and continuously improving the firewalls, load balancers, VPNs, that is critical to our day-to-day operations, applying engineering, troubleshooting, technical analysis, and problem-solving expertise to strengthen secure connectivity across the enterprise. 

Candidates must be authorized to work in the United States. We are unable to sponsor employment visas for this position.

We welcome the opportunity for this role to be hybrid based at the corporate headquarters in Freeport, Maine.

Responsibilities:

In this critical role you will work with a dedicated team of professionals to design, engineer, and support firewalls, Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), and routed and switched networks. You will support advanced problem analysis and isolate highly complex issues, develop effective working relationships with technology and business stakeholders, and maximize network performance and security through ongoing monitoring, troubleshooting, and continuous improvement. This role also includes helping define and maintain secure, repeatable infrastructure through automation and Infrastructure as Code practices, while providing technical leadership and coaching to other members of the team. This role will participate in an on-call rotation and on-site work is required.  

 Top priority technologies skills for this position:

• Zscaler Internet Access (ZIA) Operations 
  • Engineer, implement, and maintain URL filtering, Cloud App Control, and Cloud Firewall policies, and activate configuration changes following change management procedures. 
  • Manage SSL inspection rules and bypass requests, validating business justification and documenting exceptions. 
  • Maintains custom URL categories, allowlists, and blocklists, and respond to user requests for site recategorization or access exceptions. 
  • Monitor and troubleshoot GRE and IPsec tunnels from branch locations to Zscaler, including tunnel failover and location configuration. 
  • Support PAC file updates, traffic forwarding issues, and Zscaler Client Connector (ZCC) problems such as enrollment, forwarding profiles, and trusted network detection. 
  • Investigate blocked traffic and policy hits using ZIA logs and Web Insights, and escalate suspected policy design gaps to L3. 
•  Zscaler Private Access (ZPA) Operations 
  • Create and update application segments, segment groups, and server groups for new or changed internal applications based on approved requests using Infrastructure as Code. 
  • Configure and maintain access to policy rules using IdP groups, SAML/SCIM attributes, and posture profiles. 
  •  Engineer and maintain the ZPA infrastructure supporting secure application access, including App Connectors and Service Edges; monitor health, perform upgrades, and deploy new connectors using standardized provisioning and Infrastructure as Code practices. 
  • Troubleshoot user access issues across ZCC, App Connectors, DNS resolution, and backend server reachability. 
  • Use Zscaler Digital Experience (ZDX) data to diagnose user performance complaints and separate network, application, and device causes. 
• Firewall Operations 
  • Engineer, implement, and maintain firewall policies, NAT configurations, objects, and related security controls on Palo Alto firewalls. 
  • Troubleshoot complex connectivity and security issues using traffic logs, packet captures, and policy analysis, driving issues through resolution and engaging other engineering resources as appropriate. 
  • Plan and support firmware upgrades, patching, HA validation, and other lifecycle activities during established maintenance windows. 
• Monitoring and Incident Support 
  • Respond to alerts for tunnel outages, connector failures, and firewall resource issues within defined SLAs. 
  • Assist the SOC during incidents by pulling ZIA, ZPA, and firewall logs and applying emergency blocks when directed. 
  • Participate in the on-call rotation for after-hours incidents and emergency changes. 
  • Partner with Network, Service Desk, and Infrastructure Operations teams to triage and resolve ZIA, ZPA, and firewall issues within defined SLAs. 
  • Own or lead troubleshooting of complex, high-impact Zscaler and firewall issues, partnering with other engineering teams, vendors, and support resources as needed to drive incidents through resolution and identify opportunities for permanent remediation. 

Requirements:

You should have bachelor's degree in computer science, or related areas, a minimum of 7+ years of experience, and hands-on technical knowledge of networking and security.  Arista, Cisco, Palo Alto, and Zscaler certifications are all preferred. You should bring advanced knowledge of internet protocols such as HTTP(S), TCP/IP, DNS, SSL, DHCP, BGP, OSPF, MPLS, wireless (802.11*), network routing, firewalls, secure access, and switching. Solid proficiency with Palo Alto, Zscaler, Infoblox, ExtraHop, Splunk, Meraki, Netdisco, and F5 Network is expected. A strong understanding of system management and automation tools such as Ansible, Terraform, Arista CloudVisionis highly desirable, along with experience applying Infrastructure as Code practices to network and security environments. Nice to have knowledge in Windows Server and Linux operating systems. Customer service focused, excellent communication skills, and the ability to work in a team-oriented environment are important for success in this role.

L.L.Bean uses a market-based compensation approach. The anticipated starting base pay for this position is $98,100.00 - $122,600.00. Individual compensation may vary based on factors such as a candidate’s experience, qualifications, education, geographic location, skills, competencies, and proficiency for the role.

If you care about the outdoors, joining L.L.Bean is a great way to feel good about what you do. Our benefits package makes a good thing even better, with programs and perks designed to support your health and financial goals. Plus, maintaining a healthy work-life balance and re-charging outside are all part of the plan.

If your experience looks a little different from what we've identified and you think you'd be great at this role, we'd love to learn more about you!   At L.L.Bean, we believe the outdoors brings out the best in all of us.  We strive to reflect this every day in our commitments to employees and partners and in our efforts to promote belonging.