Foster City, CA (onsite) contract role focused on hands-on network security operations and scoped project delivery.

Administer next-gen firewall (NGFW) and UTM platforms, including policy changes, rule lifecycle cleanup, software and signature updates, and certificate renewals.
Run URL filtering and Layer-7 inspection policies, including category tuning and exception handling.
Perform IDS/IPS tuning with signature management, reduce false positives, and escalate confirmed detections to the Security Operations team.
Support 802.1X NAC including supplicant and authentication troubleshooting, resolving certificate and policy issues, and onboarding new device types.
Support remote access VPN activities such as client troubleshooting, access and split-tunnel policy changes, and availability monitoring.
Manage the ticket queue to meet SLA, providing clear written updates to requesters.
Maintain runbooks, network diagrams, and configuration documentation.
Design, pilot, execute phased rollout, and provide handoff documentation for:
- 802.1X expansion to additional sites and/or device classes
Perform network segmentation and SSL Decryption enforcement work, including policy design and enforcement.

5+ years of network security engineering supporting production environments.
5+ years of IT systems or application engineering and administration.
Strong working knowledge across all layers of the OSI model.
Hands-on experience with Layer-7 protection techniques, including application control, TLS inspection, IPS, URL and DNS filtering.
Direct experience administering enterprise NGFW/UTM platforms (vendors to be named from your environment).
Experience implementing and supporting 802.1X wired and wireless NAC.
Experience supporting enterprise remote access VPN.
Demonstrated ability to operate in a formal change management process.
Clear written and verbal communication, able to collaborate across Information Security, IT, Product, and Operations.

Relevant certifications (examples listed: PCNSE, Security+, CISSP).
IaC, scripting, or automation experience for configuration and reporting (examples listed: Python, Ansible, Terraform).
Experience in a regulated or safety-critical environment.

Contractor does not set security policy or standards (owned by Zoox Information Security).
Architecture decisions require Zoox review and approval; contractor provides design input and implementation.
No production changes outside the approved change management window.
All documentation, configurations, and scripts produced are Zoox work product.

Role type: hands-on engineering and administration (not an advisory role).

Salary: USD 78 - 78 per hourly

Network Security Engineer

Job Description