Job description

Job Description BAE Systems, a top-ten prime contractor to the U.S. Department of Defense, enables the U.S. government to transform data into intelligence and provides engineering, integration and sustainment support for critical military platforms and systems. Intelligence & Security provides services and products to the Department of Defense, the government, federal law enforcement officials, and troops deployed around the world. At BAE Systems, we promote a strong, collaborative culture and provide our employees with the tools, skills and training they need to succeed. We are all about trust, camaraderie, and a shared ambition to lead the world in defense technologies and national security services. We offer flexible work environment to support the balance in your life and keep you performing at your best. Be a part of a company that is part of the community; driven to improve our future and protect our freedom. We are seeking a Senior Zero Trust Architect to design, implement, and operate our Secure Service Edge (SSE) and Zero Trust security architecture. This role sits at the intersection of networking, identity, and cloud security, and is responsible for building secure, scalable access models across hybrid and cloud-first environments. The ideal candidate brings deep hands-on expertise across SSE platforms, Microsoft 365/Azure security, identity and access management, and network traffic engineering, with the judgment to troubleshoot complex issues and the communication skills to align technical and business stakeholders. • Ability to communicate complex concepts to engineers, leadership, and non-technical stakeholders • Experience working in Agile or DevOps environments • Strong collaboration across security, networking, cloud, and endpoint teams • Ability to lead or contribute to architecture decision-making • Ability to design secure hybrid and cloud-first architectures • Experience evaluating SSE vendors based on performance, security, integration, and cost • Strong documentation skills: • • Architecture diagrams • Runbooks • SOPs • Experience supporting PoCs and pilot deployments ABC Required Education, Experience, & Skills We are looking for Systems Engineer with a minimum of 11 years' relevant experience and a Bachelors' Degree. Candidate must have experience in the following: Experience in the following are required: • Experience in regulated environments (FedRAMP, DoD, GCC/GCCH/DoD tenants) • Certifications: • • Microsoft (AZ-500, SC-300, SC-200) • Zscaler (ZCCA, ZCSP) • Cloudflare Zero Trust • CISSP, CCSP, CCNP Security • Exposure to: • • Endpoint posture enforcement (Intune, Defender for Endpoint) • Browser isolation technologies • API security and SaaS governance Preferred Education, Experience, & Skills Desired Skills Include: • Microsoft Entra ID (Azure AD), including Conditional Access, Identity Protection, and PIM • Microsoft Global Secure Access (GSA) or similar SSE-native integrations • Microsoft Defender Suite (Defender for Cloud Apps, Endpoint, Identity, Office) • Experience integrating third-party SSE platforms with M365 workloads: Exchange Online, SharePoint Online, Teams, OneDrive • Understanding of Azure networking constructs: VNets, NSGs, Private Endpoints, Virtual WAN • Familiarity with Azure Firewall, Application Gateway/WAF, and private access models • TCP/IP, DNS, HTTP/S, TLS inspection, proxy architectures • Routing (BGP), NAT, VPN (IPSec/SSL), SD-WAN integrations • Experience with traffic steering methods: PAC files, GRE/IPSec tunnels, agent-based forwarding • Understanding of secure internet breakout and branch connectivity models • Ability to troubleshoot latency, packet loss, and SaaS performance issues in cloud-delivered security pipelines • Z scaler: ZIA/ZPA design, policy implementation, app segmentation • Microsoft Global Secure Access (Entra): Private & Internet Access, Conditional Access integration • Cloudflare One: SWG, Zero Trust Access, WARP client, DNS filtering • Akamai EAA: Secure application publishing, identity integration, traffic optimization Pay Information Full-Time Salary Range: $149603 - $254317 Please note: This range is based on our market pay structures. However, individual salaries are determined by a variety of factors including, but not limited to: business considerations, local market conditions, and internal equity, as well as candidate qualifications, such as skills, education, and experience. Employee Benefits: At BAE Systems, we support our employees in all aspects of their life, including their health and financial well-being. Regular employees scheduled to work 20+ hours per week are offered: health, dental, and vision insurance; health savings accounts; a 401(k) savings plan; disability coverage; and life and accident insurance. We also have an employee assistance program, a legal plan, and other perks including discounts on things like home, auto, and pet insurance. Our leave programs include paid time off, paid holidays, as well as other types of leave, including paid parental, military, bereavement, and any applicable federal and state sick leave. Employees may participate in the company recognition program to receive monetary or non-monetary recognition awards. Other incentives may be available based on position level and/or job specifics. About BAE Systems, Inc. BAE Systems, Inc. is a defense, aerospace, and security company headquartered in Falls Church, Virginia, with more than 40,000 employees worldwide. We serve, supply, and protect those who protect us. As one of the most geographically diverse international defense companies, we deliver a full range of products and services spanning air, land, maritime, space, and cyber, including advanced electronics, intelligence solutions, and dedicated customer support. Our culture is performance-driven and values-led, built on curiosity, creativity, and collaboration. Purpose isn't a tagline here. It's what drives us. We're developing breakthrough technologies that defend national security and make a lasting impact on our communities and our planet. When you join BAE Systems, you're not just building a career. You're contributing to a mission that truly matters. This position will be posted for at least 5 calendar days. The posting will remain active until the position is filled, or a qualified pool of candidates is identified.

Requirements

Must-haves

Ability to communicate complex concepts to engineers, leadership, and non-technical stakeholders
Experience working in Agile or DevOps environments
Strong collaboration across security, networking, cloud, and endpoint teams
Ability to lead or contribute to architecture decision-making
Ability to design secure hybrid and cloud-first architectures
Experience evaluating SSE vendors based on performance, security, integration, and cost
Architecture diagrams
Experience supporting PoCs and pilot deployments
Experience in regulated environments (FedRAMP, DoD, GCC/GCCH/DoD tenants)
Microsoft (AZ-500, SC-300, SC-200)
Zscaler (ZCCA, ZCSP)
Cloudflare Zero Trust
CISSP, CCSP, CCNP Security
Endpoint posture enforcement (Intune, Defender for Endpoint)
Browser isolation technologies
API security and SaaS governance
Microsoft Entra ID (Azure AD), including Conditional Access, Identity Protection, and PIM
Microsoft Global Secure Access (GSA) or similar SSE-native integrations
Microsoft Defender Suite (Defender for Cloud Apps, Endpoint, Identity, Office)
Experience integrating third-party SSE platforms with M365 workloads: Exchange Online, SharePoint Online, Teams, OneDrive
Understanding of Azure networking constructs: VNets, NSGs, Private Endpoints, Virtual WAN
Familiarity with Azure Firewall, Application Gateway/WAF, and private access models
TCP/IP, DNS, HTTP/S, TLS inspection, proxy architectures

Nice-to-haves

Preferred Education, Experience, & Skills Desired Skills Include:

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

azureagileapi

Platform: phenom
Effort: medium

Benefits

Benefits detected in the listing.

Dental

Vision

401(K)

Paid Time Off