ZTNA Security Architect (M/F)

Project overview

The mission consists of supporting our client in defining the security framework via ZTNA for the client's various use cases (partner access, applications published on the internet, access to internal applications (via ZPA or on-site).

If necessary, the Service Provider will propose a POC using the existing test environments at Safran.

The mission will cover project scoping and the production of the General Technical Architecture Document (DATG) and the Detailed Technical Architecture Document (DATD), the migration strategy, the test plan, and the integration of the solution.

The project will cover the following scope:

For the architecture definition, the architect in charge will have to work with SAFRAN experts in group domains: Network, SSI, Identity, Workstation, PKI, Applications, and Operations.

They will report to the network architect manager and the SAFRAN project manager.

The mission consists of:

Project launch

Coordination of architecture workshops

Definition of Zero Trust principles applicable to the client's use cases.

Definition of access policies according to populations, applications, location, workstation compliance level, and chosen trust levels

Formalization of technical architectures integrating existing architecture components and/or description of impacts on these components, taking into account Safran's security and urbanization principles

Writing the general technical architecture document (DATG)

Writing the detailed technical architecture document (DATD) - coordination with experts.

High-level formalization of integration operations

Writing the migration, coexistence, switchover, and rollback strategy.

Definition of the technical, security, and operational testing and acceptance plan

Skills transfer to teams.

Solution integration (build) and acceptance

Identification of impacts on existing Safran "Standards" and "deployment kits" and updating of documents

Carrying out POCs and pilots representative of the following use cases:

Use Case 1 – Protection of a Safran application exposed on the Internet: selection of an application currently protected by a WAF and validation of a Zero Trust architecture adapted to authorized users, including authentication, application access control, protection against unauthorized access, certificate management, logging, monitoring, and coexistence with existing security devices.

Use Case 2 – Partner access: implementation of controlled access to a Safran application for a partner population currently connected by IPsec tunnel, with validation of authentication and identity federation, segmentation by partner and by application, flow restriction, traceability, access revocation, and the scenario for coexistence or progressive replacement of the IPsec tunnel.

Use Case 3 – Access to internal applications via ZTNA: implementation of access to an internal application from a remote SAFRAN workstation via ZPA, then from a SAFRAN site, with validation of authentication, MFA, application segmentation, access policies according to identity and context, workstation compliance, logging, and service continuity.

• Scoping, design, and integration of Zero Trust access architectures to secure the following use cases:
• Access to internal applications (ZTNA implementation)
• Safran applications exposed on the internet (currently protected by a WAF)
• Partner access (IPsec connections)

Project details

• Start: ASAP
• Duration: 12 mois
• Remote: hybrid
• Location: Malakoff, Île-de-France, FR
• Rate: 94-94 EUR/h
• Languages: French