Lead Consultant – Network Segmentation & Zero Trust

Qualifications

Experience

• 8–12 years of experience in cybersecurity or enterprise networking with a sustained focus on segmentation and Zero Trust; must include 5+ years in a senior consulting or technical leadership role with hands-on architecture and client advisory experience.
• Demonstrated experience serving as a segmentation or Zero Trust technical SME within pursuit or sales teams, with a track record of contributing to scoping, pricing, and winning consulting engagements.
• Demonstrated experience as the lead author and final owner of client-facing security strategy and assessment documents, including assessment reports, enterprise strategies, execution plans, and executive presentations.
• Deep technical expertise across segmentation domains, including:
  • Enterprise and Data Center Segmentation: next-generation firewall zone architecture; fabric-layer and overlay-based segmentation, including VXLAN/EVPN and VRF design; and east-west enforcement strategy
  • Host-Based Microsegmentation: agent-based workload segmentation platforms, including policy model design, ringfencing strategy, dependency-driven policy authoring, and phased enforcement rollout
  • Identity- and Access-Driven Segmentation: network access control, dynamic authorization, device trust posture, and zero trust network access
  • Cloud Segmentation: cloud provider network constructs, security groups and network security groups, transit and hub-and-spoke architectures, cloud-native policy, and container and service-mesh segmentation
  • OT/ICS, IoT, and IoMT Segmentation: Purdue model and IEC 62443 zone-and-conduit design; passive asset visibility and risk platforms; and the brownfield constraints that limit enforcement options
  • Discovery and Dependency Mapping: flow collection and analysis, application dependency mapping, and translating observed traffic and dependencies into segmentation policy and zone design
• Working knowledge of Zero Trust architecture and maturity models: NIST SP 800-207, the CISA Zero Trust Maturity Model (ZTMM), the DoD Zero Trust Reference Architecture, and protect-surface methodology.
• Working knowledge of the frameworks and regulatory drivers that shape segmentation: NIST CSF 2.0, NIST SP 800-53 (SC and AC control families), NIST SP 800-171/172, PCI DSS v4 segmentation and scoping, HIPAA Security Rule, ISA/IEC 62443, NERC CIP, and FFIEC/GLBA.
• Practical understanding of the adjacent domains that determine whether a segmentation plan is executable: identity and access management, endpoint and device trust, asset management and CMDB hygiene, change management and operational readiness, and the shared platform foundations segmentation depends on.
• Preferred: experience leading segmentation programs across financial services, healthcare, manufacturing, retail, energy, or public sector, particularly where segmentation intersects with regulatory scrutiny (HIPAA, PCI DSS, NERC CIP, DORA); and experience with OT/ICS, IoT, and IoMT environments and the operational constraints that shape segmentation in those environments.
• Preferred: contributions to segmentation or Zero Trust thought leadership through white papers, conference presentations, or intellectual property; and experience with adjacent drivers of segmentation work, including M&A network integration, data center or cloud migration, PCI scope reduction, and post-incident segmentation remediation.
• Certifications desired: CISSP, CISSP-ISSAP, CISM, CRISC, or CCSP; ISA/IEC 62443 is a plus for OT-adjacent work.

Specialized Knowledge, Skills & Abilities

Working knowledge and consulting experience in at least five of the following areas:

• Enterprise Segmentation and associated technologies
• Zero Trust Architectures including ZTMM (Zero Trust Maturity Model)
• Network and Systems Security
• Cloud Security and Cloud Network Architecture
• Operational Technologies and Environments (OT/ICS, IoT, IoMT)
• Risk Management and Assessments
• Policy, Governance, and Compliance
• Identity and Access Management
• Data Protection and Privacy
• Security Operations

Demonstrated consulting delivery competencies, including:

• Structured discovery and assessment: design and execute current-state discovery across corporate/campus, data center, cloud, and OT/IoT environments; run stakeholder interviews and technical SME sessions; and synthesize findings into clearly structured, actionable outputs.
• **Gap analysi…