Job Summary

We are looking for a Junior to Staff-level Network Security Engineer specializing in Intrusion Detection and Prevention Systems (IDS/IPS). Working closely with senior architects and security operations teams, this individual will support the end-to-end lifecycle of our IDS/IPS sensors-spanning Assess, Build, Transition, and Operations. The ideal candidate has a strong foundation in network protocols, traffic analysis, and alert triage, with a keen interest in signature tuning, vulnerability detection, and maintaining high sensor availability across enterprise environments.

Responsibilities

Assess (Posture Review Signature Evaluation)

- Assist in evaluating existing network tap/SPAN port configurations and sensor placements to ensure complete visibility across critical network segments.
- Review vendor threat intelligence feeds, CVE releases, and security advisories to assess coverage gaps against emerging network attack vectors.
- Audit current IDS signature sets and inspection policies to identify noisy, legacy, or deprecated rules causing excessive false positives.
- Document sensor hardware/software versions, throughput metrics, and interface utilization to support capacity planning.

Build (Deployment, Baseline Integration)

- Support the installation, initial configuration, and staging of physical and virtual IDS/IPS appliances or software agents (e.g., Snort, Suricata, Zeek, or commercial NGFW threat engines).
- Apply baseline inspection policies, protocol anomaly detection rules, and preprocessor settings in line with internal security standards.
- Validate tap/SPAN aggregation, packet broker feeds, and interface cabling to ensure zero packet drop during traffic ingestion.
- Configure log forwarding and telemetry streaming to the central SIEM/data lake (e.g., Splunk, Microsoft Sentinel) via Syslog, JSON,



or dedicated API connectors.

Transition (Testing, Handover Documentation)

- Conduct synthetic traffic generation and controlled attack simulations (e.g., using test replay tools or benign exploit scripts) to verify detection accuracy before production cutover.
- Assist in drafting standard operating procedures (SOPs), alert escalation workflows, and initial triage playbooks for Level 1 SOC analysts.
- Document As-Deployed sensor architectures, IP allocation tables, tap mappings, and management interface credentials in the team knowledge base.
- Participate in maintenance window cutovers, executing pre- and post-validation checklists.

Operations Continuous Management

- Monitor IDS/IPS health, disk usage, memory utilization, and inspection latency; raise service tickets for degraded hardware or dropped packets.
- Perform daily triage of IDS alerts and assist SOC teams in analyzing raw packet captures (PCAP) to distinguish true attacks from benign network anomalies.
- Execute continuous rule-tuning workflows: refine thresholds, create source/destination whitelists, and suppress verified false positives to maintain high alert fidelity.
- Schedule and apply regular signature feed updates, emergency vulnerability signatures, and minor vendor engine patches.
- Maintain metric trackers covering weekly detection counts, top triggered signatures, and tuning changes for operational reporting.
- Understanding of ITIL-based Change Management,



managing end-to-end change lifecycle activities, CAB coordination, and compliant implementation of infrastructure and application changes

Required Skills and Qualifications

- Experience: 1-3 years of hands-on experience in network security operations, IDS/IPS administration, or SOC/tier-2 alert triage.
- Core Technologies: Familiarity with at least one enterprise IDS/IPS solution (commercial engines such as Palo Alto Threat Prevention, Cisco Secure IPS/Firepower, Fortinet IPS, Trend Micro TippingPoint, or open-source tools like Snort, Suricata, and Zeek).
- Protocol Packet Analysis: Robust foundational grasp of the TCP/IP suite, common application protocols (HTTP/S, DNS, DHCP, TLS, SSH), and hands-on skill using packet analysis tools (e.g., Wireshark, tcpdump).
- Signature Rule Logic: Basic understanding of how signature patterns, regular expressions, and protocol anomaly engines detect malicious behavior.
- Operating Systems: Basic to intermediate Linux command-line skills (navigating log files, viewing system resources, editing config files via vi/nano, and running basic network utilities).
- Certifications: Associate-level or foundational security certifications are preferred (e.g., CompTIA Security+, CompTIA Network+, Cisco Certified CyberOps Associate, or vendor-specific associate certifications).
- Soft Skills: Methodical troubleshooting approach, clear technical writing for documentation, and effective cross-team communication with SOC and network infrastructure groups.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.

📌 GMS-Staff-IDS Management (Bengaluru)
🏢 EY
📍 Bengaluru