Professional Services Consultant

Description

Experience might include a combination of the skills below:

• 3+ years in a customer-facing technical implementation or onboarding team, security engineering team, security operations center, or other highly technical team, including 3+ years focused on Zero Trust / SASE.
• Strong command of the OSI model and core protocols: TCP/IP, TLS (including TLSv1.3 and mTLS), DNS, HTTP/2.
• Deep understanding of Zero Trust technologies: Zero Trust Network Access (ZTNA), Secure Web Gateway (SWG), Remote Browser Isolation (RBI), Data Loss Prevention (DLP), CASB, and Cloud Email Security.
• Deep understanding of internet and security technologies: forward and reverse proxies with content filtering & DLP, sandboxing, firewalls/NGFW, WAF, bot management, rate limiting, and SSL/IPsec & SSL/TLS VPN appliances and services.
• Modern identity: SSO via SAML and OIDC, SCIM user/group provisioning and deprovisioning, LDAP/Active Directory, MFA/FIDO2, and the role of the IdP — with hands-on experience on Microsoft Entra ID, Okta, or Ping.
• DNS in depth: DNS filtering, DoH/DoT, conditional forwarding / split-DNS, internal-zone resolution, and local domain fallback.
• Endpoints: software distribution and deployment across Windows, macOS, and Linux; Windows and Linux server administration; and client-endpoint troubleshooting across all three platforms.
• Networking troubleshooting: debugging network connectivity with standard tools (packet capture, DNS/HTTP tracing).
• Ability to manage a project, work to deadlines, and prioritize between competing demands.
• Work performed in English; fluency in Spanish or Portuguese is a strong advantage.

Demonstrated technical experience (hands-on-keyboard) with:

At the senior level we expect these to be hands-on-keyboard — configured, deployed, migrated, or troubleshot in production — not just understood conceptually.

• Experience working with Reverse & Forward proxies with Content Filtering & DLP technologies
• Software distribution & deployment in Microsoft, Mac and Linux environments
• Detailed working knowledge of web based security, network segmentation, security proxies, Firewalls and NGFWs, SSL/IPSec and SSL/TLS VPN appliances & services, etc
• Integrating identity providers with enterprise applications end to end — SSO (SAML/OIDC) and SCIM provisioning, group/attribute mapping, and troubleshooting the IdP handshake.
• Windows & Linux Server system administration
• Windows, MacOS and Linux client endpoints troubleshooting
• Experience debugging Network connectivity issues using Network Troubleshooting Tools

Preferred but not mandatory:

• Automation / Infrastructure-as-Code: Terraform (ideally the Cloudflare provider), REST APIs, Python/Bash scripting, Git, CI/CD, and policy-as-code.
• Cloud platforms: AWS / Azure / GCP networking — VPC/VNet, Security Groups / NSG / NACL, cloud-native DNS resolvers (Route 53 Inbound Endpoints, Azure Private DNS), cloud IAM, and deploying connectors in IaaS.
• SASE on-ramp networking: IPsec/GRE tunnel configuration, BGP, Anycast, network segmentation for Zero Trust, and SD-WAN / MPLS / WAN-optimization background.
• MDM software distribution (Intune, Jamf).
• Identity & directory tooling: Microsoft Active Directory, GPO, Entra ID, and Intune.
• Observability: log export (Logpush) and SIEM integration (Splunk, Microsoft Sentinel, Elastic, Chronicle); Digital Experience Monitoring (DEX).
• Frameworks & compliance: NIST Zero Trust Architecture; GDPR, DORA, NIS2, ISO 27001, PCI DSS, HIPAA, SOC 2 (FedRAMP if US-government work applies).
• Certifications: CISSP, CCSP, SC-300, AZ-500, AWS Security Specialty, CCNP/CCIE, CompTIA, or equivalent are a strong plus. Forensic certifications (GCFA, GCFE, GCIA, GCIH) are welcome but not central to this role.
• Emerging: familiarity with AI security / shadow-AI governance — AI-tool discovery and gating, and AI Gateway concepts.