Network Security Engineer - IDS/IPS (Staff / Junior Level)

About the role

EY is looking for a Network Security Engineer specializing in Intrusion Detection and Prevention Systems (IDS/IPS), at junior to staff level (1-3 years of experience). Working closely with senior architects and security operations teams, the role covers the full lifecycle of IDS/IPS sensors: Assess, Build, Transition and Operations.

Key responsibilities

• Assess: review network tap/SPAN port configurations and sensor placement, audit IDS signature sets and inspection policies, and document sensor versions, throughput and interface utilization
• Build: install and configure physical and virtual IDS/IPS appliances or agents (Snort, Suricata, Zeek or commercial NGFW engines), set baseline policies and validate packet ingestion
• Configure log forwarding and telemetry to the central SIEM/data lake (Splunk, Microsoft Sentinel) via Syslog, JSON or API connectors
• Transition: run synthetic traffic and controlled attack tests, draft SOPs, alert escalation workflows and triage playbooks, and document as-deployed architectures
• Operations: monitor sensor health, triage IDS alerts and PCAPs, tune rules and signatures, and schedule feed updates and patches
• Apply ITIL-based change management, including CAB coordination

Required profile

• 1-3 years of hands-on experience in network security operations, IDS/IPS administration or SOC tier-2 alert triage
• Associate-level or foundational security certification preferred (e.g. CompTIA Security+, CompTIA Network+, Cisco CCNA CyberOps Associate)
• Methodical troubleshooting, clear technical writing and good cross-team communication

Required skills

• Familiarity with at least one enterprise IDS/IPS solution (Palo Alto, Cisco Firepower, Fortinet, Trend Micro, Snort, Suricata, Zeek)
• TCP/IP, HTTP/S, DNS, DHCP, TLS, SSH and packet analysis tools (Wireshark, tcpdump)
• Basic to intermediate Linux command-line skills