Zscaler Support Administrator (Contractor position)

Zscaler Support Administrator (Contractor position)

Salary

$70.00 Hourly

Location

10 Park Plaza, Boston

Job Type

Contractor ITS77

Remote Employment

Flexible/Hybrid

Job Number

20260723A-ITS87

Department

MBTA - Information Technology Dept

Area

031-ITD

Opening Date

07/23/2026

Closing Date

Continuous

Bargaining Unit

N/A

Licenses / Certifications

Please see job description.

Safety Sensitive

No; this is not a Safety Sensitive position.

Essential Classification (Emergency Staff)

Yes; this position is classified as essential. Employees in this role are required to report to work for their assigned work hours or as directed by supervisory personnel during declared States of Emergency.

On-Call or 24/7

Yes; this position is classified as on-call or 24/7. Employees in this role must be available to respond to page/text/call and report to work as directed by supervisor personnel.

• Description
• Benefits
• Questions

At the MBTA, we envision a thriving region enabled by a best-in-class transit system. Our mission is to serve the public by providing safe, reliable, and accessible transportation. MBTA's core values are built around safety, service, equity, sustainability, culture, and accessibility, and each employee that works for the MBTA performs their roles based on our vision, mission, and values. This includes attendance, participation, and contribution in local safety committee meetings as needed.

Job Summary

The Security Application Support (Zscaler Support Administrator) role ensures the secure implementation, configuration, and ongoing operational health of the MBTA's Secure Access Service Edge (SASE) environment and integrated security platforms. This position provides technical expertise across cloud security services, user access technologies, and threat prevention capabilities to protect MBTA systems, data, and users. The role supports both project-based initiatives and day-to-day operations, partnering closely with security engineering, infrastructure, and application teams to maintain resilient, compliant, and Zero Trust aligned security controls.

The scope of this role includes initial configuration, deployment, administration, monitoring, and continuous improvement of SASE components; integration with Microsoft cloud and endpoint protection technologies; troubleshooting of user and system issues; policy development and tuning; documentation of operational standards; and participation in threat intelligence and remediation activities. The position also contributes to security architecture enhancements, assists with cloud migration efforts, and advises on emerging security acquisitions to ensure alignment with MBTA Information Security policies, industry best practices, and regulatory requirements.

Duties & Responsibilities

• Perform initial configuration and setup of the SASE cloud (Internet Access, Private Access, digital experience, SAML, add-ons, etc.).
• Assist with various implementation projects as they relate to Azure, Intune, Office 365, and application cloud migrations.
• Investigate and apply SASE best practices.
• Provide comprehensive administration and support of the Zscaler platform (ZIA, ZPA), including daily operational tasks, policy updates, SSL inspection management, certificate workflows, log analysis, troubleshooting, and coordination with Zscaler TAC.
• Perform day-to-day administration of the SASE.
• Document SASE standard operating procedures and protocols.
• Create SASE dashboards and reports to monitor and ensure SASE health.
• Coordinate and leverage threat intelligence to prevent and remediate vulnerabilities and threats.
• Receive and fulfill technical work assignments - ServiceNow and data calls.
• Fulfill policy requests to fine tune operations of the SASE Standards that align with Information Security Policies.
• Monitor, troubleshoot and resolve user experience issues and provide remediation recommendations.
• Assist other system and security engineers in optimizing policies and user configuration.
• Document issues and escalate to next tier or vendor support, as necessary.
• Monitor systems consoles and remediate alerts.
• Perform policy administration for web proxies, URL filtering, secure web gateway, CASB, and data loss prevention.
• Support integration with Microsoft products like Azure Active Directory and Microsoft Conditional Access Policies.
• Support integration with EDR products like CrowdStrike.
• Identify and recommend Security Architecture Improvements or solutions for review by leadership and continue to be a champion of Zero Trust maturity at the MBTA.
• Serve as an advisor on new security acquisitions.
• Perform all other duties and projects that may be assigned.

Additional responsibilities may include focus on one or more departments or locations. See applicable addendum for department or location specific functions.

Physical Demands and Working Conditions

• The physical demands and work environment characteristics described here are representative of those an employee encounters while performing the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.
• Available to work any and all shifts and/or locations as assigned or directed.
• Available to work as per assignment by the MBTA twenty-four (24) hours per day, seven (7) days per week as directed by supervisory staff for severe weather conditions, emergencies or any other circumstances that may potentially impact service or the safety of service.

Supervision

• No direct reports.

Minimum Education

• Bachelor's degree from an accredited institution.

Minimum Requirements & Qualifications

• Two (2) years of experience administering or supporting cloud-based security platforms.
• Strong understanding of SASE architecture, Zero Trust principles, and cloud security best practices.
• Application support of security related applications used in EDR, PAM, SIEM or ZTNA.
• Management of ENTRA groups for use in SCIM group management.
• Understanding of Windows and MacOS systems.
• Understanding of Mobile device management (MDM) concepts.
• Strong written and verbal communication skills, and the ability to create technical reports.
• Strong analytical and troubleshooting skills.

Preferred Experience & Skills

• Application support of security related applications used in EDR, PAM, SIEM AND ZTNA.
• Experience administering or supporting Zscaler ZIA/ZPA, SSL inspection, certificate workflows, and log/traffic analysis.
• Experience with SCIM-based identity lifecycle management and advanced ENTRA ID (Azure AD) configuration.
• Working knowledge of CrowdStrike, SentinelOne, or similar EDR platforms.
• Hands-on experience with SIEM, log aggregators, or incident response tools (mirroring MBTA preferred skills patterns).
• Familiarity with PAM technologies such as CyberArk, BeyondTrust, or Delinea.
• Experience managing or tuning CASB, secure web gateway, or DLP solutions.
• Understanding of cloud networking concepts (DNS security, TLS, VPN replacements, micro-segmentation).
• Experience creating dashboards and analytics in tools such as Splunk, Elastic, Power BI, or Zscaler Insights.
• Knowledge of major Information Security frameworks (e.g., NIST 800-53 / 800-207, ISO 27001, CIS Controls).
• Experience with automation and scripting (PowerShell, Python, Bash) to streamline security operations.
• Experience with application cloud migration support and cloud-hosted service hardening.
• Knowledge of traditional and modern application architectures (client/server, n-tier, microservices).
• Certifications such as CompTIA Security+, Network+, CySA+, Zscaler ZIA/ZPA Certified Administrator, Azure Fundamentals, or GIAC.

Substitutions

• A high school diploma or GED with an additional seven (7) years of directly related experience substitutes for the bachelor's degree requirement.
• An associate's degree from an accredited institution and an additional three (3) years of directly related experience substitutes for the bachelor's degree requirement.
• A master's degree in a related subject substitutes for two (2) years of general experience.
• A nationally recognized certification, or statewide/professional certification in a related field substitutes for one (1) year of experience.

Job Conditions

• Adhere to rules, regulations, collective bargaining agreements (if applicable) and policies of the MBTA including the EEO, anti-discrimination, anti-harassment, and anti-retaliation policies.
• Ability to pass a Criminal Offender Record Information (CORI) check, background screening, and the MBTA's medical requirements, including a physical examination and drug and alcohol screening.
• Have a satisfactory work record for the two (2) years immediately prior to the closing date of this posting, including overall employment, job performance, discipline, and safety records (infractions and/or offenses occurring after the closing of the posting and before the filling of a vacancy may preclude a candidate from consideration for selection).

Job Conditions:

• Ability to effectively read, comprehend, communicate, and respond to instructions, orders, signs, notices, inquiries, etc. in English.
• Be at least eighteen (18) years of age, except if participating in an approved high school internship / co-op program.
• Ability to commute to assigned work locations in the Boston, MA metro area, as required by the role.
• Ability to provide internal and external customers with courteous and professional experiences.
• Ability to work effectively, independently, and as part of a diverse workforce team (or supervise, if required).
• Ability to uphold the rights and interests of the MBTA while building and maintaining effective relationships with employees and co-workers.
• Ability to adhere to rules, regulations, collective bargaining agreements (if applicable), and policies of the MBTA, including the EEO, anti-discrimination, anti-harassment, and anti-retaliation policies.
• Have a satisfactory work record for the two (2) years immediately prior to the closing date of this posting (unless if current student or recent graduate), including overall employment, job performance, discipline, and safety records (infractions and/or offenses occurring after the closing of the posting and before the filling of a vacancy may preclude a candidate from consideration for selection).
• Ability to pass a Criminal Offender Record Information (CORI) check, comprehensive background screening, and / or medical Clinic screening, potentially including physical examination and drug and alcohol screenings.
• Ability to work all shifts and / or locations assigned, directed, or necessary for this position, including (for some transit / operations roles) up to twenty-four (24) hours per day, seven (7) days per week as necessary to accommodate severe weather conditions, emergencies, or any other circumstances that may potentially impact service or the safety of service.
• Intern / co-op staff must be enrolled full or part-time in an accredited educational program and maintain a cumulative GPA of at least 2.5 for the entire duration of the internship / co-op. Additionally, interns / co-ops must have valid work authorization and U.S. Social Security Number prior to starting pre-employment screenings / pre-boarding, working in their positions, and throughout the duration of their program.

Disclaimers and Definitions:

• General Disclaimer: The statements contained in this job description are intended to describe a summary, general nature, and complexity of typical job functions and do not represent an exhaustive list of all duties, tasks, and responsibilities required of staff assigned to this position.
• Application Completion: It is each applicant's responsibility to ensure application details are entered completely and correctly, including updated work and education histories (past and current). Incomplete applications may not be considered. Attachments do not substitute for application fields. The recruitment team does not have access to existing employee data / history.
• Application Deadlines: Applicants should apply as soon as possible, as the MBTA may stop considering applicants after a sufficiently large applicant pool is established.
• Work Environment: The physical demands and work environment characteristics described here-in are representative of those an employee may encounter while performing the essential functions of this job. Reasonable accommodations can be made to enable individuals with disabilities to perform essential functions. See job description for role-specific requirements.
• Work Eligibility: All employees must be legally authorized to work in the United States and on an unrestricted basis. The MBTA does not have an employer work sponsorship program. However, if you have unrestricted work authorization, or are sponsored by a separate entity, you are welcome to apply. Further, all persons hired will require a U.S. Social Security Number prior to starting the position and employees will be required to complete a Form I-9 to verify their identity and eligibility to work in the U.S.
• Interviews: Candidates should ensure they arrive on time, are prepared, can remain for the duration, and if remote, are in a quiet place without distraction, for the interview. Candidates who do not attend their interview without advance authorization, including an email confirmation of a rescheduled time/date from Human Resources, will be considered a no-show and disqualified from consideration for the position. Related to rescheduling, on a one-time basis, and due to something emergent, you may be allowed to reschedule the interview. In addition, Human Resources may require documentation supporting the request. However, should you need to reschedule, you will need to contact your Recruiter directly by email.
• Safety Sensitive Positions: Employees working in this classification will be subject to periodic physical examinations plus random drug and alcohol testing.
• On-call or 24/7 Positions: Employees working in this classification must be available to respond to page / text / call and report to work as determined by assigned department or the Authority.
• Essential / Emergency Staff: During declared "states of emergency," employees working in this classification are required to report to work for their assigned work hours or as directed by management.
• ADA Accommodations: The MBTA makes reasonable accommodations for applicants with disabilities. If you require an accommodation during this process, please contact the MBTAs ADA Unit at 617-222-5751 or hradaaa@mbta.com.
• Diversity, Equity, and Inclusion: The MBTA is an Equal Employment Opportunity Employer. For terms, descriptions, and definitions related to diversity, equity, inclusion, veteran status, and immediate family members that you may find on the application form, please visit mbta.com/careers-app-definitions.
• Intern / Co-Op Benefits: Employees taking part in an internship or co-op at the MBTA are eligible to receive accrued paid sick leave as well as a monthly transportation pass, based on the city from which the intern / co-op commutes to work, at no cost. However, no additional benefits are currently offered for interns or co-ops.

This position is not eligible for benefits through the MBTA. However, some positions might be eligible to incur paid sick time or to receive a complimentary pass for travel on the MBTA transit system. Please speak with the assigned recruiter or email hrstaffing@mbta.com for more information.

01

Do you have at least two (2) years of experience administering or supporting cloud-based security platforms?

• Yes
• No

02

Do you have a strong understanding of SASE architecture, Zero Trust principles, and cloud security best practices?

• Yes
• No

03

Do you have experience with application support of security related applications used in EDR, PAM, SIEM or ZTNA?

• Yes
• No

04

Do you have experience with management of ENTRA groups for use in SCIM group management?

• Yes
• No

05

Do you have understanding of Windows and MacOS systems?

• Yes
• No

06

Do you have understanding of Mobile device management (MDM) concepts?

• Yes
• No

07

Do you have strong written and verbal communication skills, and the ability to create technical reports?

• Yes
• No

08

Are you legally authorized to work in the United States?

• Yes
• No

09

Will you now or in the future require visa sponsorship to continue working in the United States (e.g. H-1B visa status)?

• Yes
• No

Required Question

Employer Massachusetts Bay Transportation Authority

Address 10 Park Plaza

Boston, Massachusetts, 02116

Phone (617) 222-3200

Website https://www.mbta.com