Job Title: Network Security Engineer

Location:  Foster City CA 

Duration: 12 months 

Bill Rate: $78/hour (C2C)

Job Type: W-2, 1099, C2C

Client: To Be Discussed Later

Work Authorization: US Citizen, Green Card, OPT-EAD, CPT, H-1B, H4-EAD, Other

Role Description:

This is a hands-on engineering and administration role, not an advisory one.

 Day-to-day operations:

· Administer next-gen firewall / UTM platforms: policy changes, rule lifecycle and cleanup, software and signature updates, certificate renewals.

· Operate URL filtering and Layer-7 inspection policies, including category tuning and exception handling

· IDS/IPS tuning: signature management, false positive reduction, escalation of confirmed detections to our security operations team

· Support 802.1X network access control: supplicant and authentication troubleshooting, certificate and policy issues, onboarding new device types.

· Support remote access VPN: client troubleshooting, access and split-tunnel policy changes, availability monitoring.

· Work the ticket queue to SLA with clear written updates to requesters

· Maintain runbooks, network diagrams, and configuration documentation

Project Responsibilities (scoped deliverables)

The contractor will also be assigned scoped project work. Anticipated projects include:

· [802.1X expansion to additional sites / device classes] — design, pilot, phased rollout, and handoff documentation

· [Network segmentation and SSL Decryption enforcement work] — policy design and enforcement

Each project will be defined with a written statement of work, acceptance criteria, and target completion date before work begins.

 Required Qualifications:

· 5+ years of network security engineering supporting production environments

· 5+ years of IT systems or application engineering and administration

· Strong working knowledge of all layers of the OSI model

· Hands-on experience with Layer-7 protection techniques (application control, TLS inspection, IPS, URL and DNS filtering)

· Direct experience administering enterprise NGFW/UTM platforms [name the vendors you run]

· Experience implementing and supporting 802.1X wired and wireless NAC

· Experience with enterprise remote access VPN

· Demonstrated experience operating within a formal change management process

· Clear written and verbal communication, with the ability to work across Information Security, IT, Product, and Operations teams

 Preferred:

· Relevant certifications [e.g. PCNSE, Security+, CISSP]

· IaC, scripting or automation experience for configuration and reporting [Python, Ansible, Terraform]

· Experience in a regulated or safety-critical environment

Engagement Boundaries

· Contractor does not set security policy or standards; those remain owned by Zoox Information Security

· Architecture decisions require Zoox review and approval; the contractor contributes design input and implementation

· No production changes outside the approved change management window

· All documentation, configurations, and scripts produced are Zoox work product

Success Measures

· Ticket SLA attainment and requester satisfaction

· Change success rate and absence of change-caused incidents

· Project milestones delivered on agreed dates

· Completeness and accuracy of documentation at handoff