Architect - Zero Trust Network Access (ZTNA)

Architect - Zero Trust Network Access (ZTNA)

Location: London
Division/Department: Infrastructure/GTI/End User Computing

1. 1. Role Overview

The Remote Access team within End User Computing is responsible for delivering secure remote access capabilities for both corporate and BYOD devices across the organisation. Operating within an agile environment, the team is structured into dedicated delivery squads, each focused on a specific technology domain.

The Architect will be responsible for leading the design, engineering, and evolution of the Zero Trust Network Access (ZTNA) platform supporting both corporate and personal iOS, Windows, and macOS devices. This role will drive the development of secure access solutions, work closely with Product Management on backlog refinement and prioritisation, and ensure an optimal balance between security, scalability, and user experience.

1. 2. Key Responsibilities

• Design, develop, and enhance a global Zero Trust Network Access solution supporting over 100,000 users.
• Identify opportunities for automation, telemetry improvements, and operational efficiencies.
• Drive platform enhancements and work with vendors to improve product capabilities.
• Provide technical leadership for ZTNA engineering initiatives and roadmap delivery.
• Manage complex technical issues, problem management activities, and L3 support escalations.
• Build and maintain technical documentation, including solution designs, release notes, testing documentation, and operational procedures.
• Collaborate with technology, security, and infrastructure teams to ensure solutions meet security, compliance, and engineering standards.
• Design and document Zero Trust architecture, standards, and implementation strategies.
• Oversee engineering activities across the ZTNA platform estate.
• Ensure adherence to SDLC, engineering governance, and release management processes.

1. 3. Required Skills & Experience

Technical Expertise

• Extensive hands-on experience delivering VPN, Remote Access, and Cyber Security solutions within large enterprise environments.
• Strong understanding of networking protocols and technologies, including:
  • IP Networking
  • Routing
  • TLS
  • SSL VPN
  • ESP
  • IKEv2
  • ActiveSync
  • ICA
  • RDP
• Experience designing highly available and resilient infrastructure solutions, including:
  • Data Centres
  • Virtualisation Platforms
  • Enterprise Networks
  • Disaster Recovery & Resilience Models
• Strong expertise in Palo Alto Prisma Access and Zero Trust Network Access (ZTNA).
• Understanding of:
  • Citrix
  • Microsoft Azure MFA
  • SAML-based Authentication
  • Azure Active Directory
  • Conditional Access
  • DNS
  • DHCP
  • PKI Certificate Infrastructure
• Experience working with APIs and integration tools such as Postman or Bruno.
• Strong troubleshooting and problem-solving capabilities in medium to large enterprise environments.

Desirable Skills

• Knowledge of Agile delivery methodologies and best practices.
• Experience with:
  • Jira
  • Confluence
  • Splunk
  • Fiddler
  • Wireshark
  • ServiceNow
• Exposure to Windows, macOS, iOS, and Android platforms.

1. 4. Education & Certifications

• Bachelor's degree or equivalent qualification.
• Agile and/or ITIL certification preferred.
• Relevant networking and cybersecurity certifications desirable.

1. 5. Candidate Profile

The successful candidate will be:

• A hands-on technical expert with strong networking and security architecture experience.
• An excellent communicator with strong documentation skills.
• Comfortable engaging with both technical and non-technical stakeholders.
• Organised, proactive, and focused on continuous platform improvement.
• Analytical, logical, and solution-oriented.
• Able to challenge existing designs and processes constructively.
• Experienced working across globally distributed teams and multiple time zones.
• Passionate about staying current with emerging cybersecurity threats and industry best practices.

Key Technologies

Palo Alto Prisma Access | ZTNA | Azure AD | Conditional Access | SAML | VPN | SSL VPN | PKI | DNS | DHCP | Citrix | Wireshark | Splunk | ServiceNow | Jira | Confluence