Senior Network Security Engineer - Zscaler

Watchmen is one of the fastest-growing IT consultancy companies in the Benelux (FD Gazellen Award 2024 & 2025). 100% by engineers, for engineers. We are a collective of subject-matter experts in Cloud, Network & Security, guiding Enterprise clients in realising Zero Trust. We hold the largest number of Zscaler Aces in the Benelux, and our clients include ABN Amro, Ministry of Defense, and the Dutch National Police. We are expanding across Europe and are looking for professionals with hands-on Zscaler experience,at engineer, senior engineer, or architect level. This role is primarily remote with occasional travel to clients in the Benelux area and Germany. We offer as much remote flexibility as the client engagement allows. We hire across the EU. Depending on where you're based, this can be structured as employment via our Dutch or Belgian entity, or as a contracting arrangement. Conditions:• A competitive salary in line with your experience and certification level, benchmarked against the market for senior Zscaler expertise.• An unlimited certification and training budget.• Remote working with occasional travel may be required by individual client engagements.• Direct access to our CEO and leadership team from day one, no layers between you and the people making decisions.• Working alongside the largest concentration of Zscaler expertise in the Benelux, on Zero Trust programmes at national-scale organisations.

Overview:As a Zscaler specialist at Watchmen you take ownership of Zero Trust transformation at enterprise clients, designing, deploying, and operating ZIA, ZPA and ZDX environments. Depending on your level, that means anything from hands-on migration and policy engineering through to owning the target architecture and advising client stakeholders on how they get there. You are the technical authority in the room. Our clients don't buy hours, they buy outcomes, and you help them achieve those. Responsibilities:• Design and implement Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA) and Zscaler Digital Experience (ZDX) at enterprise scale.• Lead migrations from legacy VPN, proxy and perimeter-based architectures to a Zero Trust model.• Build and tune access policies, SSL inspection, DLP and segmentation aligned to client security requirements.• Integrate Zscaler with identity providers (Entra ID, Okta), SIEM/SOAR platforms and the wider client security stack.• Troubleshoot complex connectivity, routing and performance issues across hybrid environments.• Advise client architects and security leads on Zero Trust strategy, roadmap and adoption.• Share knowledge internally and help develop the Zscaler capability across the team. Qualifications and Requirements:• Demonstrable hands-on experience with Zscaler in a production enterprise environment, ZIA and/or ZPA.• Solid networking foundation: routing, DNS, TLS/SSL, proxy behaviour, GRE/IPSec tunnelling.• Understanding of Zero Trust and SASE/SSE principles beyond the vendor marketing.• Experience working with or advising enterprise clients, and the communication skills to hold your ground with them.• Fluent English. • EU work authorisation. *German, Dutch, and/or French, is a strong advantage for the German, NL, and BE markets. Advantageous:• Zscaler certifications, ZDTA, ZIA-EA, ZPA-EA, or ZTCA.• Zscaler Ace status.• Broader security vendor experience: Palo Alto (PCNSE, PCSAE), Cisco, Netskope, Fortinet.• Automation experience: Python, Ansible, Terraform.