Zscaler Security Services Architect Associate Director

At EY, we’re all in to shape your future with confidence.

We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world.

Technology has always been at the heart of what we do and deliver at EY. We need technology to keep an organization the size of ours working efficiently and securely. Our people, applications, cloud platforms, data centers, Al services and business-critical systems rely on modern security capabilities that enable secure access, protect sensitive information and reduce cyber risk.

Within Security Technology Services (STS), Network Security Technology delivers global Zero Trust, secure access, outbound protection and selected Al security services. The Zscaler platform service portfolio supports this mission through ZPA, ZlA, Zscaler Cloud Gateway, Zscaler Al Firewall, Zscaler Deception and Azure Zero Trust strategy capabilities.

The Opportunity

We are seeking a Zscaler Service Owner - Associate Director to join STS Network Security Technology and lead Zscaler services within Network Security.

This senior service leadership role is accountable for converting Zscaler platform investments into governed, supportable and measurable enterprise services. The role owns service strategy, roadmap, financial planning, service introduction, operational readiness, adoption, performance, risk, compliance, vendor outcomes and continuous improvement across the portfolio.

The approved service portfolio includes:

• Zscaler Al Firewall for secure Al access, including Zscaler Al Guard and Al Broker capabilities.

• Zscaler lnternet Access for secure outbound protection across cloud, office and data center traffic flows.

• Zscaler Private Access for private application access and reduction of internet-facing application exposure.

• Zscaler Cloud Gateway for controlled cloud and internet egress patterns aligned to Zero Trust operating requirements.

• Azure Zero Trust strategy for secure cloud networking, private access patterns and migration away from broad public exposure.

• Zscaler Deception for approved deception-based detection and response use cases within the Network Security service boundary.

The role will partner across Network Security, Architecture, Engineering, Operations, Cloud Technology, Enterprise Technology, ldentity, Data Protection, Monitoring and Response, Application Security, Service Lines and Zscaler to transition capabilities into sustainable global services.

Your Key Responsibilities

The Zscaler Service Owner will provide strategic and operational leadership for services assigned to STS Network Security Technology.

Zscaler Platform Service Portfolio Ownership

• Define the service vision, scope, outcomes, roadmap and lifecycle for each assigned Zscaler platform capability within Network Security.

• Translate Zscaler platform objectives into clear service offerings, service tiers, customer journeys, support models and measurable outcomes.

• Maintain an integrated service portfolio limited to ZPA, ZlA, Zscaler Cloud Gateway, Al Firewall, Zscaler

• Deception and Azure Zero Trust strategy capabilities.

• Own service acceptance criteria and ensure project delivery is not complete until operational readiness, supportability, controls, documentation and ownership are in place.

• Prioritize enhancements, technical debt, resilience improvements and adoption initiatives based on business value, security risk and service performance.

Al Security Services

• Own the service delivery model for inline inspection and policy enforcement for user-to-Al, application-to-Al, agent-to-agent and Model Context Protocol-based communications within the approved Zscaler scope.

• Coordinate delivery and adoption of the Al Firewall service construct, where Al Guard and Al Broker form part of the capability set, including policy governance, service onboarding, operating procedures, telemetry, escalation and control evidence.

• Own service integration requirements with Al platforms, gateways, identity, data protection, monitoring, incident response and governance processes.

• Ensure Al security services support approved use cases while managing data leakage, unauthorized access, unsafe tool use and emerging Al-specific threats.

Zero Trust Outbound Traffic Services

• Own cloud and on-premises outbound security services delivered through Zscaler Cloud Gateway and Zscaler lnternet Access.

• Coordinate service design and adoption for routing, inspection, policy enforcement, threat prevention, encrypted traffic inspection and data protection.

• Define onboarding patterns, exception governance, customer responsibilities, service dependencies and operational hand-offs for cloud and data center environments.

• Establish service measures for coverage, policy compliance, availability, user impact and risk-reduction outcomes.

Private Access and Attack Surface Reduction

• Own the service roadmap for migrating eligible applications from public exposure and broad network access to identity-based, application-specific access.

• Lead the service model for Zscaler Private Access, least-privilege access, application segmentation and Zero Trust B2B connectivity.

• Partner with application, cloud and infrastructure owners to establish repeatable onboarding, validation, support and decommissioning processes.

• Govern service exceptions and ensure that residual public exposure or broad access is documented, risk-assessed and time-bound.

Azure Zero Trust Strategy and Segmentation Enablement

• Contribute to Azure Zero Trust strategy by defining secure segmentation, private access, workload connectivity principles within the approved service scope.

• Define service boundaries for user-to-application, application-to-application and workload connectivity patterns aligned to Zero Trust principles.

• Coordinate readiness across architecture, engineering, platform operations, application teams and support providers.

• Ensure approved segmentation and access patterns include policy models, exception processes, change controls, monitoring, recovery procedures and evidence requirements.

Service Strategy, Roadmap and Governance

• Create and maintain a multi-year service and capability roadmap aligned with the Zscaler platform service portfolio and STS Network Security strategy.

• Chair service governance forums and provide clear decisions, actions, dependencies, risks and escalations.

• Establish service policies, standards, operating models, RACl, controls and decision rights.

• Provide executive reporting on roadmap delivery, adoption, service health, security outcomes, financial position and material risks.

• Ensure roadmap commitments are aligned across Zscaler, STS Architecture, Engineering, Operations and dependent technology functions.

Service lntroduction and Operational Readiness

• Own the transition of new or enhanced Zscaler platform capabilities from program delivery into production-ready services.

• Define and approve operational readiness requirements covering support model, monitoring, alerting, runbooks, knowledge articles, capacity, continuity, access administration, escalation paths, training and vendor support.

• Ensure production acceptance includes control validation, service metrics, support agreements, documented dependencies and accountable owners.

• Coordinate early-life support and confirm exit criteria before capabilities move to business-as-usual operations.

• Prevent unsupported technology deployment by making service readiness and evidence mandatory delivery gates.

Service Performance and Continuous lmprovement

• Define and govern service-level objectives, key performance indicators, risk indicators and outcome measures.

• Review service availability, incidents, problems, changes, capacity, adoption, policy effectiveness and customer experience.

• Lead major service reviews and ensure root causes, systemic issues and corrective actions are owned throughclosure.

• Use operational data and customer feedback to improve service quality, resilience, automation and usability.

• Drive standardization and automation across onboarding, policy management, evidence collection, reporting and control validation.

Risk, Control and Compliance Accountability

• Ensure services operate in accordance with EY security requirements, architecture standards, change controls and audit expectations.

• Own service-level control design, evidence requirements, control operation oversight and remediation tracking.

• Maintain an auditable record of service decisions, exceptions, risk acceptance, control validation and closure evidence.

• Partner with risk, compliance, privacy, data protection and legal stakeholders where Al security and Zscaler platform services introduce additional obligations.

Financial, Commercial and Vendor Management

• Own service financial planning, forecasts, licensing assumptions, support costs and investment proposals.

• Develop business cases for service expansion, adoption and remediation priorities.

• Act as the senior service relationship lead for Zscaler and relevant delivery partners.

• Govern vendor performance against contractual commitments, support agreements, product roadmaps,implementation outcomes and service levels.

• Drive license utilization, value realization and cost optimization without reducing required security outcomes.

• Coordinate product roadmap discussions so emerging Zscaler capabilities are assessed against Network Security priorities and operating requirements.

Stakeholder, Adoption and Customer Leadership

• Build trusted relationships with STS leadership, Network Security platform stakeholders, technology functions, service lines and business stakeholders.

• Communicate the purpose, value, service boundaries, adoption requirements and customer responsibilities for each capability.

• Create stakeholder-specific adoption plans and ensure application, cloud, infrastructure and user communities can consume services consistently.

• Lead resolution of cross-functional dependencies and escalates decisions that affect scope, risk, funding, schedule or service viability.

• Translate complex security and technology matters into clear executive decisions and business outcomes.

Leadership and Team Development

• Lead a global virtual service team spanning service management, architecture, engineering, operations, project delivery and vendor resources.

• Set clear objectives, accountability and ways of working across teams that may not report directly into the role.

• Coach service managers, product specialists and technical leads in service ownership and outcome-based delivery.

• Promote a culture of evidence-led delivery, customer focus, automation, operational discipline and continuous improvement.

• Act as the senior escalation point for service-level issues, competing priorities and material delivery risks.

Skills and Attributes for Success

• We are interested in candidates who combine strategic service ownership, cybersecurity expertise, commercial discipline and pragmatic delivery leadership in a complex global enterprise.

• Demonstrated ability to own an enterprise security service from strategy and investment through transition, operation, improvement and retirement.

• Strong understanding of Zero Trust, Security Service Edge, secure access, segmentation, cloud networking andAl security service concepts.

• Ability to translate programs and product capabilities into consumable, governed and supportable services.

• Strong command of lT service management practices, including service design, transition, incident, problem, change, availability, capacity, continuity and continual improvement.

• Experience defining service metrics and presenting service performance, risk, value and roadmap decisions to senior stakeholders.

• Commercial and vendor management capability, including licensing, support agreements, roadmap influence and value realization.

• Ability to lead through influence across global, cross-functional and cross-border teams.

• Excellent written and verbal communication, negotiation, decision-making and executive stakeholder management skills.

• Ability to operate effectively in an ambiguous, fast-moving environment where Al-related risks, technologies and business priorities continue to evolve.

To Qualify for the Role, You Must Have

• Bachelor's degree in Computer Science, lnformation Technology, Engineering, Cybersecurity, Business Management or equivalent experience.

• 18+ years of overall experience across cybersecurity, network security and infrastructure security.

• 8+ years of experience with Zscaler platforms and services, including service ownership, delivery leadership, product management or operations leadership for global technology services.

• Experience managing enterprise-scale security or network services in a complex global environment.

• Deep experience with Zscaler services in the defined scope, including ZPA, ZlA, Zscaler Cloud Gateway, Al Firewall and Zscaler Deception, with working knowledge of Azure Zero Trust strategy and secure access patterns.

• Experience supporting enterprise adoption of new technology capabilities and establishing sustainable operating and support models.

• Experience managing service financials, vendor relationships, risks, controls, audit requirements and executive governance.

• Experience leading major transformation initiatives that require coordination across architecture, engineering operations and business stakeholders.

• Strong English communication skills, both written and verbal.

ldeally, You'll Also Have

• Experience delivering services for secure Al adoption, GenAl platforms, Al agents or Al-enabled applications.

• Knowledge of Zscaler Al Firewall capabilities, including Al Guard and Al Broker, together with ZPA, ZlA, Zscaler Cloud Gateway, Zscaler Deception and Azure Zero Trust strategy.

• Understanding of Azure secure networking and enterprise integration dependencies such as Virtual WAN, ExpressRoute, Azure Firewall, Private Link, Private Endpoint and APl gateways.

• Experience with identity integration, data protection, security monitoring, SlEM/SOAR and operational evidence collection.

• lTlL Managing Professional, lTlL Strategic Leader or equivalent service management credentials.

• Zscaler certifications relevant to ZlA, ZPA, service delivery or architecture.

• ClSSP, CCSP, TOGAF, PMP, Azure or equivalent security, architecture, cloud or program credentials.

What We Look For

We are looking for a senior service leader who is accountable for outcomes, not just platform operation. The ideal candidate can create a clear service strategy, mobilize cross-functional teams, challenge incomplete delivery, establish auditable controls and convert Zscaler platform investments into reliable services the enterprise can adopt with confidence.

The successful candidate will balance innovation with operational discipline, enabling rapid adoption of Zscaler capabilities while ensuring every service has a defined customer, measurable outcome, approved operating model, sustainable funding, clear ownership and evidence of control effectiveness.

What we offer you

The compensation ranges below are provided in order to comply with United States pay transparency laws. Other geographies will follow their local salary guidelines, which may not be a direct conversion of published US salary ranges. At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers.

• We offer a comprehensive compensation and benefits package where you’ll be rewarded based on your performance and recognized for the value you bring to the business. The base salary range for this job is:

• New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices – $180,000 to $324,000

• Bay Area California offices – $187,500 to $337,500

• All other offices locations in the US, including Sacramento – $150,000 to $297,000

• Individual salaries within these ranges are determined through a wide variety of factors including but not limited to education, experience, knowledge, skills and geography. In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options.

• Under our flexible vacation policy, you’ll decide how much vacation time you need based on your own personal circumstances. You’ll also be granted time off for designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being.

EY | Building a better working world

EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets.

Enabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow.

EY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories.

All in to shape the future with confidence.

EY provides equal employment opportunities to applicants and employees without regard to race, color, religion, age, sex, sexual orientation, gender identity/expression, pregnancy, genetic information, national origin, protected veteran status, disability status, or any other legally protected basis, including arrest and conviction records, in accordance with applicable law.

EY is committed to providing reasonable accommodation to qualified individuals with disabilities including veterans with disabilities. If you have a disability and either need assistance applying online or need to request an accommodation during any part of the application process, please call 1-800-EY-HELP3, select Option 2 for candidate related inquiries, then select Option 1 for candidate queries and finally select Option 2 for candidates with an inquiry which will route you to EY’s Talent Shared Services Team (TSS) or email the TSS at View email address on click.appcast.io .