Design and Implement a Zero-Trust Network Architecture for Financial Institution (Hybrid Cloud)

We require an experienced network security specialist to design and implement a comprehensive Zero-Trust Network Architecture for our financial institution. Our environment is currently hybrid, consisting of on-premise infrastructure and AWS cloud services (EC2 instances, S3 buckets, RDS databases). The proposed solution must incorporate micro-segmentation, multi-factor authentication (MFA) for all users and devices, continuous device posture assessment, least privilege access control, and robust threat detection capabilities. The solution should integrate with our existing Active Directory infrastructure and leverage cloud-native security services where appropriate. A detailed implementation plan, including network diagrams, configuration guides, and testing procedures, is required. The candidate should have a strong understanding of Zero-Trust principles, network security best practices, and experience with relevant technologies such as firewalls (e.g., Palo Alto Networks, Fortinet), intrusion detection/prevention systems (IDS/IPS), security information and event management (SIEM) platforms, and cloud security tools. We need this implemented by someone who can handle complex deployments in a regulated environment with strict compliance requirements (PCI DSS, GDPR). The deliverable includes documentation for ongoing maintenance and a training plan for our internal IT staff.