You already figured out a pretty good solution to this in your side question.
For the record, I wouldn’t attempt this: If you want to work from “Mexico” and your employer has a problem with it, better to find an alternate employer.
Based off your description, I’m guessing you are using a company issued laptop, and don’t want them to know you are using this laptop from “Mexico”. Because of that, and because you don’t know what kind of monitoring/reporting they have on that device, you need to consider that laptop “compromised”, as in any measures you take on that device to fool zscaler could be countered or reported at an time. If their IT team has their shit together enough to be using zscaler, they are probably using some kind of security tool that can report everything running on the device, including any other vpn clients, which would throw a red flag.
So yes, the solution is to handle the circumvention from outside your “compromised” laptop, and to control it at the router level instead.
You should consider setting up a router running openwrt, and configuring it to COMPLETLY send ALL internet traffic through a VPN service that will make your egress appear where you want it to. Here is a decent guide for setting up openwrt to go through NordVPN for example:
https://support.nordvpn.com/Connectivity/Router/1047411192/OpenWRT-CI-setup-with-NordVPN.htm
Note, I don’t really recommend NordVPN, this guide just covers all the basic gotchas for the setup, for example, ensuring DNS traffic isn’t leaked outside the VPN. Just make sure you do all the same configs on your router with whichever openvpn provider you use.
If this is the only internet connection your laptop uses to get to the internet, zscaler shouldn’t be able to determine that you are connecting from anywhere else.
Again, disclaimer, I haven’t actually tried this, so unless you have the opportunity to do some testing and confirm things are working as expected, exercise caution.
Now, the gotcha:
The reason NordVPN is a bad idea for this is that, as far as VPNs go, they are pretty famous. As such, while it will look make it appear as if you are connecting from the US (if you use the correct NordVPN server), they will also be able to tell that it’s coming from a NordVPN IP. If they are paying attention to that, it’s just as bad of a red flag. In fact, that will be the case for any provider you use. You could maybe fly a bit under the radar by setting up your own openvpn server, if you know how to, but again, if you host it in a major data center like AWS or even a colo, seeing your traffic come from that IP would be just as suspicious.
Your best option, if you are going this route, would be to host your own openvpn server on a linux machine at a residential address in the US.
But the better option:
If you can: leave the laptop where it’s supposed to be.
Basically, what I would do is leave the laptop in the US, again, at a residential address you trust and/or have control over. It’s much easier to just remote into your laptop from elsewhere, and then use it. All the traffic from the laptop will show up as coming from where it’s supposed to.
If you want to be a little risky, you could put remote access software on the laptop like LogmeIn, Teamviewer, etc, but again, you are trying to fly under the radar, so maybe a less known software like splashtop.
But still, again, any of these might be blocked or detected at any time.
So what’s the REAL best answer?
KVM over IP, something like this:
https://www.amazon.com/Extender-Keyboard-Ethernet-Network-Latency/dp/B07N2M5YYR/ref=sr_1_3?keywords=ip%2Bkvm&qid=1673837702&sr=8-3&ufe=app_do%3Aamzn1.fos.f5122f16-c3e8-4386-bf32-63e904010ad0&th=1
Remember, the best solution is one outside the “compromised” device.
You connect the laptop to one of these things.
To the laptop, you’ve simply plugged in a monitor, keyboard, and mouse.
You remote into the KVM over the internet, and presto, it’s like you are sitting there with the laptop. Some can even do remote power on, etc.
Configure the laptop to use the kvm monitor as the only monitor, since you won’t be there to see the built in laptop screen.
Especially if you have a friend,etc, you can call to put hands on the device in the rare occassion something goes wrong (power failure, loss of internet, etc) this is probably the safest and most fullproof way to accomplish what you want.