Network Administrator

ITEX, an ITCON Services Partner is seeking an Administrator 1: Security Policy & User Support Lead to administer, optimize, and support TIGTA's (U.S. Treasury Inspector General for Tax Administration) enterprise security access environment. The Lead will have primary responsibility for Zscaler security policy administration, user connectivity support, data protection controls, and operational coordination across approximately 60 geographically distributed offices and 800 users.

The Lead will work independently to translate federal security requirements and business needs into sustainable access policies; troubleshoot user-impacting security and connectivity issues; coordinate incident response with network, help desk, and Security Operations Center personnel; and develop the documentation and training needed for reliable, compliant operations.

At ITEX, we offer competitive compensation, paid training and development opportunities, healthcare benefits that start on your first day, work-life balance, and the opportunity to work alongside an amazing and growing team.

Applicants must be U.S. citizens and must hold, or be able to
btain and maintain, a favorably adjudicated Tier 2 Moderate Risk Public Trust background investigation. Employment is contingent upon completion of TIGTA security screening, including applicable tax compliance, criminal-history, fingerprint, suitability, and continuous-vetting requirements.

Key Responsibilities

• Administer and optimize Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), and Zscaler Digital Experience (ZDX) services supporting approximately 800 users across 60 office locations.
• Design, implement, test, and maintain web-filtering policies, SSL inspection, data loss prevention (DLP) rules, Cloud Access Security Broker (CASB) controls, cloud-application controls, bandwidth policies, and role-based access configurations.
• Lead integration of Microsoft Purview Information Protection with Zscaler DLP, including sensitivity-label synchronization, classification-based protection policies, Microsoft 365 repository scanning, and automated discovery and remediation of sensitive data.
• Plan and execute migration from blacklist-based web filtering to a role-based whitelist model by analyzing 90 to 120 days of traffic, developing business-use baselines, conducting shadow-mode testing, managing exceptions, and supporting phased production rollout.
• Provide day-to-day user support for secure internet and private-application access; diagnose client, authentication, policy, application, and connectivity issues; document resolutions; and communicate clearly with affected users.
• Investigate DLP alerts, policy violations, potential data-exfiltration events, and web-based security incidents; preserve appropriate records; coordinate with the Security Operations Center; and implement authorized emergency policy changes.
• Monitor platform health, user experience, traffic patterns, policy effectiveness, and service performance; identify trends and recommend improvements that strengthen security without unnecessarily disrupting mission operations.
• Coordinate with network administrators supporting Cisco switches, routers, firewalls, wireless controllers, and related infrastructure when resolving end-to-end connectivity or secure-access issues.
• Develop and maintain administrator runbooks, standard operating procedures, security-policy documentation, incident-response workflows, user guides, exception-request procedures, and knowledge articles.
• Deliver training and knowledge transfer to help desk personnel, backup administrators, and end users, including accessible training materials and support documentation consistent with Section 508 requirements.
• Support VoIP and Microsoft Teams Voice activities, related troubleshooting, and cross-functional telecommunications efforts as assigned.
• Protect Controlled Unclassified Information (CUI), use only Government-authorized systems and equipment, complete required annual cybersecurity/privacy and disclosure training, and comply with TIGTA nondisclosure and access-control requirements.

Required Skills and Qualifications

• Bachelor's degree in science, technology, engineering, mathematics, information systems, networking, cybersecurity, or a closely related field.
• Minimum of six (6) years of progressively responsible experience in enterprise network administration, secure-access service edge, cybersecurity operations, network security policy, or a directly related discipline.
• Demonstrated hands-on experience administering Zscaler services, including ZIA and ZPA, with experience in ZDX, web filtering, DLP, SSL inspection, CASB, cloud-application controls, and security-policy troubleshooting.
• Experience supporting enterprise user populations and independently resolving complex secure-access, authentication, application-access, and connectivity incidents.
• Experience implementing or administering data-classification and information-protection controls using Microsoft Purview or a comparable enterprise platform.
• Working knowledge of Cisco-based enterprise networking and the ability to collaborate across switching, routing, firewall, wireless, DNS, identity, and endpoint dependencies.
• Current professional certification from Cisco or Microsoft. Examples include CCNA, CCNP Enterprise, Microsoft Certified: Cybersecurity Architect Expert, Microsoft 365 Certified: Administrator Expert, or another certification directly relevant to the assigned work.
• Experience with VoIP and current working knowledge of Microsoft Teams Voice.
• Ability to work independently, exercise sound technical judgment, manage competing priorities, and communicate risks, outages, and recommended actions to technical and nontechnical stakeholders.
• Strong written and verbal communication skills, including demonstrated ability to produce operational procedures, technical documentation, user guidance, and training materials.
• U.S. citizenship or permanent-resident status and ability to obtain and maintain TIGTA staff-like logical and physical access, including a Tier 2 Moderate Risk Public Trust determination or higher.

Desired Skills and Qualifications

• Zscaler certification such as Zscaler Certified Administrator, Zscaler Certified Engineer, or comparable role-based credential.
• Experience integrating Microsoft Purview sensitivity labels with third-party DLP or CASB platforms.
• Experience developing role-based whitelists from enterprise web-traffic analysis and conducting shadow-mode or phased policy deployments.
• Experience supporting federal Zero Trust architecture, FISMA controls, CUI safeguards, HSPD-12 requirements, and Security Executive Agent Directive 3 reporting obligations.
• Experience supporting a federal inspector general, law-enforcement, audit, investigative, or similarly security-sensitive mission environment.
• Experience creating Section 508-conformant technical documentation and delivering training to administrators, service desk staff, and end users.
• Experience with IT service management, incident response, change control, root-cause analysis, and continuous service improvement.