JOB TITLE: ZSCALER ZIA/ZPA IMPLEMENTATION EXPERTISE

LOCATION: 6041 GOSSELIES, BELGIUM

LANGUAGES: FRENCH, DUTCH, ENGLISH

WORK MODE: PART -TIME (3 DAYS A WEEK)

DURATION: 01/09/2026 - 30/11/2026 + POSSIBLE OF EXTENSION

Mission: Zscaler ZIA & ZPA Migration – Design, Documentation & Implementation

Background

The Expert Consultant will support CLIENT in accelerating the migration from the existing FortiClient/FortiEMS-based remote access solution to Zscaler's Zero Trust platform.

CLIENT resources will work alongside the consultant for support, knowledge transfer, and shadowing throughout the engagement.

The mission includes:

•Designing the target Zscaler architecture

•Creating architecture and operational documentation

•Implementing Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA)

•Gradually migrating users and applications

•Supporting technical and operational teams

The environment includes integrations with:

•Microsoft Azure Entra ID

•Microsoft Intune

•Mobile devices

•Telephony systems

•Critical business applications

•SIEM solutions

Mission Objectives

The consultant will be responsible for:

1.Designing the target architecture for ZIA and ZPA.

2.Producing complete architecture documentation.

3.Defining and implementing Zscaler technical components.

4.Preparing the migration from FortiClient VPN to ZPA.

5.Planning and supporting the ZIA migration.

6.Identifying optimization opportunities within the Zscaler tenant.

7.Supporting CLIENT teams during design, pilot, and migration phases.

Scope of Work

1. Architecture & Assessment

Current Environment Analysis

•Analyze existing ZIA configurations

•Review FortiClient VPN usage

•Identify VPN-accessed applications

•Analyze network traffic flows

•Identify technical and organizational dependencies

2. Target Architecture Design

Design architectures for:

•Zscaler Internet Access (ZIA)

•Zscaler Private Access (ZPA)

•App Connectors

•Private Service Edge (if required)





•Azure Entra ID Integration

•SCIM Provisioning

•SIEM Integration

•Microsoft Intune Integration

•BYOD & Mobile Devices

Additional considerations:

•Telephony impact analysis

•Bidirectional traffic flows

•Bypass mechanisms

•Performance optimization

•Latency requirements

Architecture Documentation

The consultant will prepare:

•High-Level Design (HLD)

•Low-Level Design (LLD)

•Technical Architecture Document (DAT)

Documentation must include:

•ZIA Architecture

•ZPA Architecture

•Azure Entra ID Integration

•SCIM Integration

•App Connectors

•Service Edge Design

•SIEM Integration

•CMDB Documentation

Operational Documentation

Prepare operational documents including:

•Support Procedures

•Troubleshooting Guides

•Migration Procedures

•Operational Documentation (Level 1–3)

ZIA Implementation

Tenant Assessment

•Review existing or new tenant

•Define migration strategy

•Configure tenant

Authentication

•Configure Azure Entra ID

•Implement SCIM provisioning (if required)

ZIA Migration

•Migrate existing configurations

•Validate security policies

•Validate GRE tunnels

•Configure Transparent Proxy (if applicable)

•Validate Explicit Proxy configuration

Logging & Monitoring

•Integrate with SIEM

•Define logging strategy

•Validate event routing

ZPA Infrastructure

Infrastructure Deployment

•Deploy App Connectors

•Configure High Availability

•Validate Capacity

•Validate Performance

Application Discovery & Reverse Engineering

Analyze VPN-accessed applications, including:

•SAP

•OpenScape





•Follow-Me Printing

•RDP Environments

•Business-specific Applications

Activities include:

•Identify FQDNs

•Identify Wildcard Domains

•Identify Application Dependencies

•Define App Segments

User Population Migration

Prepare migration for:

•Windows 11 Workstations

•Laptops

•OT Environments (if applicable)

•External Service Providers

•Android Devices

•Smartphones

Migration Support

Pilot Phase

•Prepare UAT Environment

•Execute Pilot Migration

•Perform Functional Validation

Deployment

•Define Deployment Strategy

•Execute Wave-based Migration

Support & Knowledge Transfer

The consultant will provide:

•Knowledge Transfer Sessions

•Operations Team Training

•Support Team Training

•Go-Live Support

Expected Deliverables

The consultant will deliver:

•High-Level Design (HLD) – ZIA & ZPA

•Low-Level Design (LLD) – ZIA & ZPA

•Technical Architecture Document (DAT)

•Azure Entra ID / SCIM Architecture

•App Connector Design

•Service Edge Design

•ZPA Application Catalog

•Application Flow & Dependency Mapping

•VPN to ZPA Migration Plan

•Operational Guides

•Support Procedures

•Knowledge Transfer Documentation

•Final Project Report

Project Phases

The engagement will be executed in the following phases:

1.Analysis & Scoping

2.Architecture Design

3.Documentation

4.ZIA Implementation

5.ZPA Implementation

6.Pilot Deployment

7.Migration Execution

8.Knowledge Transfer & Project Closure

Skills

•ZDTE certification or higher

•Language requirement: Level of English B2 on the European CEFR scale

•Language requirement: Level of French B2 on the European CEFR scale

•Expertise in network security aspects

•Experience with Zscaler

•Experience in a similar Zscaler migration project-Must Have

•Experience in producing and monitoring operational and technical documentation of systems

📌 Zscaler zia/zpa implementation expertise (España)
🏢 Onesource Consulting
📍 España