{"id":1935579,"url":"https://alion.io/job/asrc-federal-zero-trust-network-access-architectengineer-2","title":"Zero Trust Network Access Architect/Engineer","company":{"id":1959316,"name":"ASRC Federal","domain":"asrcfederal.com","url":"https://alion.io/company/asrcfederal","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Dayforce","truth_index":{"grade":"A","score":95,"open_postings":243,"ghost_share":0,"stale_share":0.21,"repost_share":0,"time_to_fill_p50_days":33,"computed_at":"2026-10-21T05:46:15Z"}},"role":"Networking","role_family":"Networking","seniority":"staff","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Quantico, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":107000,"max_usd":214000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":134},"experience_years_min":12,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"DLP","optional":false},{"name":"IAM","optional":false},{"name":"Okta","optional":false},{"name":"SIEM","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-10-05T04:00:00Z","employer_posted_date":"2026-10-20","last_verified_at":"2026-10-22T02:02:25Z","board_verified":true,"closed_at":null,"days_open":16,"trust":{"level":"ok","repost_count":1,"flags":[],"days_open":16},"description":"Position Description:\nASRC Federal is actively hiring a Senior Zero Trust Network Architect / Principal Engineer in support of our Defense Counterintelligence Security Agency (DCSA) program based out of Quantico, VA.\nWe are seeking an industry-leading cybersecurity expert with a deep specialization in Zero Trust Network Architecture (ZTNA) and Secure Access Service Edge (SASE). The successful candidate will serve as the chief technical authority for the design, orchestration, implementation, and long-term governance of our enterprise security boundaries.\nIn this role, you will lead the strategic modernization of DCSA's hybrid workforce infrastructure. You will leverage Palo Alto Networks (Panorama, GlobalProtect) and Versa Networks SASE platforms to establish a highly resilient, identity-aware, and context-driven security posture.\nThis is primarily a Telework position with a requirement to be onsite at least two (2) days a week or as needed at Quantico Marine Corps Base VA. Additional onsite time may be required during initial onboarding and program integration.\nMinimum Requirements: \nExperience:\nMinimum of 10 years of progressive experience in network security engineering, enterprise architecture, and infrastructure security.\nAt least 3–4 years of direct experience architecting and implementing Zero Trust frameworks (NIST SP 800-207) and SASE solutions in enterprise or federal environments.\nTechnical Mastery:\nAdvanced architecture-level knowledge of Palo Alto Networks enterprise solutions, including deep management expertise via Panorama and secure access deployments using GlobalProtect.\nDeep technical proficiency in designing and deploying Versa Networks SASE (SD-WAN, Secure Web Gateway, Cloud Access Security Broker, and Firewall-as-a-Service).\nSecurity Clearance: Active Secret Clearance REQUIRED, must be eligible to be upgraded to TS/SCI.\nCompliance: Must meet 8140 certification requirements (e.g. CISM, CISSP-ISSAP, CISSP-ISSEP, GCIA, GDSA, GICSP)\nEducation: Bachelor’s Degree in Cybersecurity, Computer Engineering, Information Systems Management, or a related field. A Master's degree or an equivalent combination of military service and 12+ years of highly relevant experience is accepted.\nDesired Vendor Certifications:\nPalo Alto Networks Certified Network Security Engineer (PCNSE)\nPalo Alto Networks Certified Zero Trust Network Security Engineer (PCZTNSE)\nVersa Certified SASE Professional (VCSP) or Versa Certified SASE Specialist (VCSS)\n\nResponsibilities:\nStrategic Architecture & Engineering\nServe as the Principal Architect for the DCSA Zero Trust journey, establishing the technical roadmap, reference architectures, and engineering guidelines aligned with NIST SP 800-207 standards.\nLead the end-to-end design, implementation, and optimization of Palo Alto GlobalProtect and Versa Networks SASE to secure cloud, hybrid on-premises, and mobile endpoints.\nDefine and govern global security policy templates within Palo Alto Panorama to enforce micro-segmentation, application-level security, and threat prevention.\nPolicy, Governance & Optimization\nArchitect advanced data loss prevention (DLP), SSL/TLS decryption, and threat prevention strategies across all egress and ingress points.\nConduct regular architectural reviews of the SASE and ZTNA configurations to identify performance bottlenecks, configuration drifts, or security gaps, providing advanced mitigation strategies.\nIdentity & Ecosystem Integration\nCollaborate with Identity and Access Management (IAM) teams to integrate ZTNA/SASE policies with identity providers (e.g., Okta, Azure AD), ensuring device posture, user context, and continuous authentication are evaluated in real time.\nGuide the integration of Versa SASE and Palo Alto platforms with existing Security Operations Center (SOC) environments, including SIEM, SOAR, and endpoint detection (EDR/XDR) tools.\nTechnical Leadership & Mentorship\nProvide technical leadership and guidance to the cybersecurity engineering team, serving as the tier-4 escalations point for complex architectural, routing, and access control challenges.\nAuthor enterprise-level high-level designs (HLD), low-level designs (LLD), system security plans (SSP), and change-management policies for executive-level and government stakeholders.\nVendor & Capability Evaluation\nStay abreast of the latest Palo Alto PAN-OS and Versa Networks feature sets, performing proof-of-concepts (PoC) to evaluate and deploy next-generation capabilities.\nChampion security-as-code and automation initiatives, using APIs and orchestration tools to automate secure connectivity and zero-touch deployments.\n Work Environment and Physical Demands: \nThis is primarily a Telework position with a requirement to be onsite at least two (2) days a week or as needed at Quantico Marine Corps Base VA. Additional onsite time may be required during initial onboarding and program integration.\nIf alternate worksite is other than DCSA facilities or corporate office space, must have the reliable ability to communicate over voice (cell phone preferred) and stable, capable internet connection\nMust be able to communicate complex technical ideas to a diverse customer base both verbally and in written form","description_format":"text","description_chars":5220,"description_truncated":false,"requirements":{"experience_years_min":12,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"master","optional":true},"security_clearance":true,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Network Security","Digital Government","IT Consulting & Digital Transformation"],"lifecycle":[{"event":"open","at":"2026-10-05T23:31:50Z"},{"event":"close","at":"2026-10-14T20:14:05Z"},{"event":"reopen","at":"2026-10-20T05:47:50Z"}],"visa":[],"liveness":{"score":87,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.969,"p_room":0.9,"age_days":16,"expected_fill_days":33,"reasons":["conf:2","urgency","velocity","win:mid","comp:brand"],"computed_at":"2026-10-21T05:46:15Z"},"pay":null,"html_url":"https://alion.io/job/asrc-federal-zero-trust-network-access-architectengineer-2","json_url":"https://alion.io/job/asrc-federal-zero-trust-network-access-architectengineer-2.json","meta":{"generated_at":"2026-10-22T03:02:24Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2680,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1959316},"rest":"https://alion.io/mcp/rest/get_company?id=1959316"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fasrc-federal-zero-trust-network-access-architectengineer-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fasrc-federal-zero-trust-network-access-architectengineer-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fasrc-federal-zero-trust-network-access-architectengineer-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/asrc-federal-zero-trust-network-access-architectengineer-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fasrc-federal-zero-trust-network-access-architectengineer-2"}]}