Zero Trust Network Access Architect/Engineer

ABOUT PRISM

PRISM is devoted to modernization and innovation within the world of technology, security, and IT enterprise solutions. We are recognized for meeting performance requirements and exceeding customer expectations since 1994. Our culture is founded on relationships, opportunity, and success. Offering comprehensive benefit plans including medical, dental, vision, and 401K along with our people - first approach sustains our reputation as a premier employer.

PRISM is seeking a Senior Zero Trust Network Architect / Principal Engineer to lead the design, orchestration, and long-term governance of enterprise security boundaries. Based out of Quantico, VA (hybrid telework with 2 days/week onsite), you will serve as the chief technical authority driving the modernization of hybrid workforce infrastructure using Palo Alto Networks (Panorama, GlobalProtect) and Versa Networks SASE platforms to enforce a resilient, identity-aware security posture.

KEY RESPONSIBILITIES:

Strategic Architecture & Engineering

• Serve as the Principal Architect for the Programs Zero Trust journey, establishing the technical roadmap, reference architectures, and engineering guidelines aligned with NIST SP 800-207 standards.
• Lead the end-to-end design, implementation, and optimization of Palo Alto GlobalProtect and Versa Networks SASE to secure cloud, hybrid on-premises, and mobile endpoints.
• Define and govern global security policy templates within Palo Alto Panorama to enforce micro-segmentation, application-level security, and threat prevention.

Policy, Governance & Optimization

• Architect advanced data loss prevention (DLP), SSL/TLS decryption, and threat prevention strategies across all egress and ingress points.
• Conduct regular architectural reviews of the SASE and ZTNA configurations to identify performance bottlenecks, configuration drifts, or security gaps, providing advanced mitigation strategies.

Identity & Ecosystem Integration

• Collaborate with Identity and Access Management (IAM) teams to integrate ZTNA/SASE policies with identity providers (e.g., Okta, Azure AD), ensuring device posture, user context, and continuous authentication are evaluated in real time.
• Guide the integration of Versa SASE and Palo Alto platforms with existing Security Operations Center (SOC) environments, including SIEM, SOAR, and endpoint detection (EDR/XDR) tools.

Technical Leadership & Mentorship

• Provide technical leadership and guidance to the cybersecurity engineering team, serving as the tier-4 escalations point for complex architectural, routing, and access control challenges.
• Author enterprise-level high-level designs (HLD), low-level designs (LLD), system security plans (SSP), and change-management policies for executive-level and government stakeholders.

Vendor & Capability Evaluation

• Stay abreast of the latest Palo Alto PAN-OS and Versa Networks feature sets, performing proof-of-concepts (PoC) to evaluate and deploy next-generation capabilities.
• Champion security-as-code and automation initiatives, using APIs and orchestration tools to automate secure connectivity and zero-touch deployments.

REQUIRED QUALIFICATIONS:(SKILLS/EDUCATION):

• Minimum of 10 years of progressive experience in network security engineering, enterprise architecture, and infrastructure security.
• At least 3-4 years of direct experience architecting and implementing Zero Trust frameworks (NIST SP 800-207) and SASE solutions in enterprise or federal environments.
• Advanced architecture-level knowledge of Palo Alto Networks enterprise solutions, including deep management expertise via Panorama and secure access deployments using GlobalProtect.
• Deep technical proficiency in designing and deploying Versa Networks SASE (SD-WAN, Secure Web Gateway, Cloud Access Security Broker, and Firewall-as-a-Service).
• Security Clearance: Active Secret Clearance REQUIRED, must be eligible to be upgraded to TS/SCI.
• Compliance: Must meet 8140 certification requirements (e.g. CISM, CISSP-ISSAP, CISSP-ISSEP, GCIA, GDSA, GICSP)
• Education: Bachelor's Degree in Cybersecurity, Computer Engineering, Information Systems Management, or a related field. A Master's degree or an equivalent combination of military service and 12+ years of highly relevant experience is accepted.

DESIRED QUALIFICATIONS:

• Palo Alto Networks Certified Network Security Engineer (PCNSE).
• Palo Alto Networks Certified Zero Trust Network Security Engineer (PCZTNSE).
• Versa Certified SASE Professional (VCSP) or Versa Certified SASE Specialist (VCSS).

REQUIRED SECURITY CLEARANCE:

• Active Secret Clearance

PRISM is an Equal Opportunity/Affirmative Action employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or veteran status, or any other protected class.