Zero Trust Security Architect (ZTNA) – Zscaler ZPA

Project overview

Context

The Digital and Information Systems Department (DDSI) is continuing the transformation and securing of access mechanisms to the Safran Group's resources.

The project's objective is to define a target architecture based on Zero Trust principles, to deliver application access controlled according to user identity, connection context, workstation status, and applicable security policies.

The target architecture must build upon the Zero Trust components already available within SAFRAN and specifically study the positioning of a Zscaler Private Access (ZPA) solution within the access chain to environments.

The Service Provider's response must include the following elements:

Missions

The mission consists of supporting SAFRAN in framing the security of various Safran use cases via ZTNA (partner access, applications published on the internet, internal application access (via ZPA or on-site).

If necessary, the Service Provider will propose a POC using existing test environments at Safran.

The mission will cover project framing and the production of the General Technical Architecture Document (DATG) and the Detailed Technical Architecture Document (DATD), migration strategy, test plan, and solution integration.

The project will cover the following scope:

For the architecture definition, the assigned architect will work with SAFRAN's group domain experts: Network, SSI, Identity, Workstation, PKI, Applications, and Operations.

They will report to the network architects' manager and the SAFRAN project manager.

The mission consists of:

Project launch

Coordination of architecture workshops

Definition of Zero Trust principles applicable to Safran use cases.

Definition of access policies based on populations, applications, location, workstation compliance level, and chosen trust levels

Formalization of technical architectures integrating existing architecture components and/or describing impacts on these components, taking into account Safran's security and urbanization principles

Writing the general technical architecture document (DATG)

Writing the detailed technical architecture document (DATD) - coordination with experts.

High-level formalization of integration operations

Writing the migration, coexistence, cutover, and rollback strategy.

Definition of the technical, security, and operational testing and acceptance plan

Skills transfer to SAFRAN teams.

Solution integration (build) and acceptance

Identification of impacts on existing Safran "Standards" and "deployment kits" and updating of documents

Carrying out POCs and pilots representative of the following use cases:

Use Case 1 – Protection of a Safran application exposed on the Internet: selection of an application currently protected by a WAF and validation of a Zero Trust architecture adapted for authorized users, including authentication, application access control, protection against unauthorized access, certificate management, logging, monitoring, and coexistence with existing security devices.

Use Case 2 – Partner access: implementation of controlled access to a Safran application for a partner population currently connected by IPsec tunnel, with validation of authentication and identity federation, segmentation by partner and application, traffic restriction, traceability, access revocation, and the scenario for coexistence or progressive replacement of the IPsec tunnel.

Use Case 3 – Access to internal applications via ZTNA: implementation of access to an internal application from a remote SAFRAN workstation via ZPA, then from a SAFRAN site, with validation of authentication, MFA, application segmentation, access policies based on identity and context, workstation compliance, logging, and service continuity.

Technical and Functional Environment

Organizational Context:

On the DSI-C SAFRAN side, the project team includes:

Referent Network and Security Architecture

Team in charge of the Zero Trust / Zscaler platform

Identity, Active Directory, MFA, and PKI teams

Workstation teams

Applications Team

Operations Teams

Project Manager

Chief Information Security Officer

Technical Context:

Existing Zscaler services, particularly ZPA and ZIA depending on their role in the target architecture;

Identity services, directories, multi-factor authentication, and certificates;

DNS, PKI, firewall, proxy, logging, and monitoring services;

SAFRAN workstations and authorized external workstations depending on the chosen use cases.

Additional Information

Deliverables:

Project framing note, scope, exclusions, assumptions, and governance, schedule

Minutes and materials from the Kick-Off, workshops, technical committees, and steering committees

Status report and mapping of the existing architecture

Inventory of portals, populations, applications, flows, controls, certificates, and dependencies

Functional, technical, security, and operational requirements document

Comparative study of architecture scenarios with advantages, limitations, risks, impacts, and macro costs

General Technical Architecture Document "DATG" Zero Trust

Detailed Technical Architecture Document "DATD" Zero Trust

Pilot document and test/acceptance plan with acceptance criteria

Migration, coexistence, cutover, rollback strategy

Proposals for updating Standard and Deployment Kit documents

Skills transfer support and closing report

All documents must be written in English.

Project Schedule

The Service Provider will propose a detailed schedule consistent with the completion of the service by 06/30/2027.

POC realization and validation by 02/28/2027 at the latest

Pilot realization and validation by 04/30/2027 at the latest

The schedule must identify the critical path, SAFRAN dependencies, and decision points for deliverable reviews.

• Acceptance of the delivery schedule: including report submission dates / proposal of an alternative delivery schedule if necessary;
• Provisional organization to meet SAFRAN's request Consultation document
• Zero Trust Solution for Safran;
• Implementation methodology for this type of service;
• Framing, design, and integration of Zero Trust access architectures to secure the following use cases:
• Access to internal applications (ZTNA implementation from ZPA or from Safran sites)
• Safran applications exposed on the internet (currently protected by a WAF)
• Partner access (IPsec connections)

Project details

• Start: flexible
• Remote: hybrid
• Location: 92240 Malakoff, France, FR
• Rate: 78-78 EUR/h
• Languages: French