Network Security Engineer – IDS/IPS

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all. 

Network Security Engineer – IDS/IPS (Staff / Junior Level)

Experience Level: 1–3 Years

Role Overview

We are looking for a Junior to Staff-level Network Security Engineer specializing in Intrusion Detection and Prevention Systems (IDS/IPS). Working closely with senior architects and security operations teams, this individual will support the end-to-end lifecycle of our IDS/IPS sensors—spanning Assess, Build, Transition, and Operations. The ideal candidate has a strong foundation in network protocols, traffic analysis, and alert triage, with a keen interest in signature tuning, vulnerability detection, and maintaining high sensor availability across enterprise environments.

Key Responsibilities

Assess (Posture Review & Signature Evaluation)

• Assist in evaluating existing network tap/SPAN port configurations and sensor placements to ensure complete visibility across critical network segments.
• Review vendor threat intelligence feeds, CVE releases, and security advisories to assess coverage gaps against emerging network attack vectors.
• Audit current IDS signature sets and inspection policies to identify noisy, legacy, or deprecated rules causing excessive false positives.
• Document sensor hardware/software versions, throughput metrics, and interface utilization to support capacity planning.

Build (Deployment, Baseline & Integration)

• Support the installation, initial configuration, and staging of physical and virtual IDS/IPS appliances or software agents (e.g., Snort, Suricata, Zeek, or commercial NGFW threat engines).
• Apply baseline inspection policies, protocol anomaly detection rules, and preprocessor settings in line with internal security standards.
• Validate tap/SPAN aggregation, packet broker feeds, and interface cabling to ensure zero packet drop during traffic ingestion.
• Configure log forwarding and telemetry streaming to the central SIEM/data lake (e.g., Splunk, Microsoft Sentinel) via Syslog, JSON, or dedicated API connectors.

Transition (Testing, Handover & Documentation)

• Conduct synthetic traffic generation and controlled attack simulations (e.g., using test replay tools or benign exploit scripts) to verify detection accuracy before production cutover.
• Assist in drafting standard operating procedures (SOPs), alert escalation workflows, and initial triage playbooks for Level 1 SOC analysts.
• Document "As-Deployed" sensor architectures, IP allocation tables, tap mappings, and management interface credentials in the team knowledge base.
• Participate in maintenance window cutovers, executing pre- and post-validation checklists.

Operations & Continuous Management

• Monitor IDS/IPS health, disk usage, memory utilization, and inspection latency; raise service tickets for degraded hardware or dropped packets.
• Perform daily triage of IDS alerts and assist SOC teams in analyzing raw packet captures (PCAP) to distinguish true attacks from benign network anomalies.
• Execute continuous rule-tuning workflows: refine thresholds, create source/destination whitelists, and suppress verified false positives to maintain high alert fidelity.
• Schedule and apply regular signature feed updates, emergency vulnerability signatures, and minor vendor engine patches.
• Maintain metric trackers covering weekly detection counts, top triggered signatures, and tuning changes for operational reporting.
• Understanding of  ITIL-based Change Management, managing end-to-end change lifecycle activities, CAB coordination, and compliant implementation of infrastructure and application changes

Required Skills & Qualifications

• Experience: 1–3 years of hands-on experience in network security operations, IDS/IPS administration, or SOC/tier-2 alert triage.
• Core Technologies: Familiarity with at least one enterprise IDS/IPS solution (commercial engines such as Palo Alto Threat Prevention, Cisco Secure IPS/Firepower, Fortinet IPS, Trend Micro TippingPoint, or open-source tools like Snort, Suricata, and Zeek).
• Protocol & Packet Analysis: Strong foundational grasp of the TCP/IP suite, common application protocols (HTTP/S, DNS, DHCP, TLS, SSH), and hands-on skill using packet analysis tools (e.g., Wireshark, tcpdump).
• Signature & Rule Logic: Basic understanding of how signature patterns, regular expressions, and protocol anomaly engines detect malicious behavior.
• Operating Systems: Basic to intermediate Linux command-line skills (navigating log files, viewing system resources, editing config files via vi/nano, and running basic network utilities).
• Certifications: Associate-level or foundational security certifications are preferred (e.g., CompTIA Security+, CompTIA Network+, Cisco Certified CyberOps Associate, or vendor-specific associate certifications).
• Soft Skills: Methodical troubleshooting approach, clear technical writing for documentation, and effective cross-team communication with SOC and network infrastructure groups.

EY | Building a better working world 

 
EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets.  

 
Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate.  

 
Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today.