About AppGate
AppGate secures and protects an organization's most valuable assets with its high-performance Zero Trust Network Access (ZTNA) solution. AppGate ZTNA is the only direct-routed Zero Trust solution built for peak performance, superior protection and seamless interoperability. AppGate safeguards enterprises and government agencies worldwide. Learn more at appgate.com.
About the Role
The Senior Sales Engineer (SE) is the senior pre-sales subject matter expert for AppGate ZTNA and owns the technical engagement with commercial prospects from first meeting through technical win. The Senior SE uncovers the business problems driving each opportunity, defines the technical requirements and constraints, designs the target-state architecture and clearly articulates the business value of AppGate ZTNA to both technical and executive audiences.
The Senior SE then communicates that end-state vision to every internal team responsible for converting the prospect to a customer and delivering a successful implementation. This includes handing off documented requirements to the Solutions Architects who lead proofs of concept and proofs of value (PoC/PoV), which allows the Senior SE to engage across a broad set of new opportunities.
The Senior SE works closely with Sales, Solutions Architecture, Implementation, Operations, Product Management and Marketing, as well as strategic technology partners, to propose complex integrated solutions that include AppGate ZTNA and key partner platforms. The ideal candidate pairs deep networking, identity and security expertise with business acumen and executive presence, as well as serving as a trusted advisor to customers and a respected technical voice inside AppGate.
Key Responsibilities
Discovery and opportunity strategy
• Leads discovery to identify the business problems, technical requirements and constraints that shape an AppGate ZTNA solution, and documents them for the account team.
• Partners with Account Executives on strategic and tactical account planning and owns the technical-win strategy for each opportunity
• Hands off documented business drivers, requirements and constraints to the Solutions Architect who owns the PoC/PoV, and supports the evaluation through to technical win.
Solution Design
• Designs AppGate ZTNA architectures, including Controller, Gateway and Connector placement, high availability, identity provider integration and the policy model (Sites, Policies, Entitlements and Conditions).
• Sizes solutions and develops the technical configuration, including quoting and internal approvals as necessary.
• Designs integrations with strategic partner platforms such as identity providers, endpoint detection and response (EDR), security information and event management (SIEM) and public cloud services.
• Provides technical and design continuity at handoff to implementation teams, and supports new services, upgrades and expansion opportunities.
Customer Engagement
• Leads technical presentations, whiteboard sessions, in-depth requirements workshops and demonstrations for audiences ranging from engineers to CISOs.
• Articulates AppGate's direct-routed differentiation against cloud-proxied ZTNA, SASE and legacy VPN alternatives.
• Serves as technical lead for RFP, RFI and security questionnaire responses.
• Provides technical support at trade shows, customer events and other forums.
Internal Leadership
• Represents the voice of the customer to Product Management and Engineering with clear, actionable field feedback.
• Mentors other Sales Engineers and contributes reusable assets such as demos, reference designs and competitive talk tracks.
• Delivers deep-dive technical training on AppGate products and solutions to internal and external stakeholders, and partners with the channel SE team to support partner enablement as needed.
• Identifies novel ways to demonstrate and articulate new AppGate features, capabilities and integrations.
Requirements
Required Qualifications
• Strong communication and stakeholder management skills
• 8+ years of experience as a Sales Engineer or in an equivalent customer-facing technical role in cybersecurity, including 3+ years with ZTNA, SASE, remote access VPN or network security solutions.
• Expert-level TCP/IP networking knowledge, including routing, NAT, DNS, firewall policy, split and full tunneling, and overlapping IP address space.
• Deep knowledge of authentication protocols and services, including Active Directory/LDAP, RADIUS, SAML, OIDC and multi-factor authentication (MFA), with hands-on experience integrating identity providers such as Microsoft Entra ID, Okta or Ping Identity.
• Strong understanding of PKI and encryption standards, including X.509 certificates, mutual TLS (mTLS), TLS, AES and RSA.
• Demonstrated experience designing and articulating connectivity to public cloud services, including Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP).
• Hands-on experience with network security solutions such as next-generation firewalls (NGFW), VPNs and network access control (NAC).
• Working knowledge of virtualization platforms such as VMware vSphere, Microsoft Hyper-V, KVM and Nutanix AHV.
• Proficiency with Linux administration and scripting against RESTful APIs in languages such as Python, PowerShell or JavaScript.
• Proven ability to translate complex access requirements into least-privilege policy designs.
• Working knowledge of the ZTNA, SASE and legacy VPN competitive landscape.
• Executive presence and excellent written communication, including technical proposals, solution designs and RFP responses.
Preferred Qualifications
• Experience in [ZTNA, fraud prevention, identity/security]
• Hands-on experience with AppGate ZTNA, including its predecessor AppGate SDP.
• Experience with infrastructure as code (IaC) tools such as Terraform.
• Familiarity with container networking, including Kubernetes and Docker.
• Experience with EDR and device posture platforms such as CrowdStrike Falcon, and SIEM platforms such as Splunk or Microsoft Sentinel.
• Familiarity with Zero Trust and compliance frameworks such as NIST SP 800-207, the CISA Zero Trust Maturity Model, PCI DSS, HIPAA, SOC 2, ISO 27001, NIS2 and DORA.
• Experience securing operational technology (OT), industrial control system (ICS) and IoT environments, including remote access to programmable logic controllers (PLCs), human-machine interfaces (HMIs) and supervisory control and data acquisition (SCADA) systems.
• Familiarity with OT architectures and standards such as the Purdue Model, IT/OT segmentation, industrial protocols (Modbus, DNP3 and OPC UA), IEC 62443 and NERC CIP, and with securing third-party vendor access to industrial sites.
• Familiarity with agentic AI, including how AI agents, Model Context Protocol (MCP) servers and other non-human identities access enterprise applications and data, and how Zero Trust access controls apply to them.
• Hands-on experience using AI assistants and agentic tools to accelerate pre-sales work such as discovery preparation, RFP responses, solution designs and demo automation.
• Current CISSP, CCNP, CCIE, AWS, Microsoft Azure or Google Cloud professional-level certification, or equivalent.
Compensation
• Salary range: 175K - 225K
Travel
• 5-25%
AppGate is An Equal Opportunity/Affirmative Action Employer and a federal contractor subject to the Rehabilitation Act of 1973 and the Vietnam Era Veterans Readjustment Assistance Act of 1974 as amended, and their corresponding regulations. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status, age or any other federally protected class. Further, AppGate is an affirmative action employer committed to taking positive steps to employ, advance in employment and otherwise afford equal employment opportunity to protected veterans and individuals with disabilities. In furtherance of AppGate’s policy regarding affirmative action and equal employment opportunity, AppGate has developed a written affirmative action program. This program is available for review upon request by any applicant or employee during normal business hours by contacting the company’s EEO Coordinator.