Network Security Engineer IDS/IPS (Staff / Junior Level)

Role Overview

We are looking for a Junior to Staff-level Network Security Engineer specializing in Intrusion Detection and Prevention Systems (IDS/IPS). Working closely with senior architects and security operations teams, this individual will support the end-to-end lifecycle of our IDS/IPS sensors spanning Assess, Build, Transition, and Operations. The ideal candidate has a strong foundation in network protocols, traffic analysis, and alert triage, with a keen interest in signature tuning, vulnerability detection, and maintaining high sensor availability across enterprise environments.

Key Responsibilities

Assess (Posture Review Signature Evaluation)

- Assist in evaluating existing network tap/SPAN port configurations and sensor placements to ensure complete visibility across critical network segments.
- Review vendor threat intelligence feeds, CVE releases, and security advisories to assess coverage gaps against emerging network attack vectors.
- Audit current IDS signature sets and inspection policies to identify noisy, legacy, or deprecated rules causing excessive false positives.
- Document sensor hardware/software versions, throughput metrics, and interface utilization to support capacity planning.

Build (Deployment, Baseline Integration)

- Support the installation, initial configuration, and staging of physical and virtual IDS/IPS appliances or software agents (e.g., Snort, Suricata, Zeek, or commercial NGFW threat engines).
- Apply baseline inspection policies, protocol anomaly detection rules, and preprocessor settings in line with internal security standards.
- Validate tap/SPAN aggregation, packet broker feeds, and interface cabling to ensure zero packet drop during traffic ingestion.




- Configure log forwarding and telemetry streaming to the central SIEM/data lake (e.g., Splunk, Microsoft Sentinel) via Syslog, JSON, or dedicated API connectors.

Transition (Testing, Handover Documentation)

- Conduct synthetic traffic generation and controlled attack simulations (e.g., using test replay tools or benign exploit scripts) to verify detection accuracy before production cutover.
- Assist in drafting standard operating procedures (SOPs), alert escalation workflows, and initial triage playbooks for Level 1 SOC analysts.
- Document "As-Deployed" sensor architectures, IP allocation tables, tap mappings, and management interface credentials in the team knowledge base.
- Participate in maintenance window cutovers, executing pre- and post-validation checklists.

Operations Continuous Management

- Monitor IDS/IPS health, disk usage, memory utilization, and inspection latency; raise service tickets for degraded hardware or dropped packets.
- Perform daily triage of IDS alerts and assist SOC teams in analyzing raw packet captures (PCAP) to distinguish true attacks from benign network anomalies.
- Execute continuous rule-tuning workflows: refine thresholds, create source/destination whitelists, and suppress verified false positives to maintain high alert fidelity.
- Schedule and apply regular signature feed updates, emergency vulnerability signatures, and minor vendor engine patches.




- Maintain metric trackers covering weekly detection counts, top triggered signatures, and tuning changes for operational reporting.
- Understanding of ITIL-based Change Management, managing end-to-end change lifecycle activities, CAB coordination, and compliant implementation of infrastructure and application changes

Required Skills Qualifications

- Experience: 13 years of hands-on experience in network security operations, IDS/IPS administration, or SOC/tier-2 alert triage.
- Core Technologies: Familiarity with at least one enterprise IDS/IPS solution (commercial engines such as Palo Alto Threat Prevention, Cisco Secure IPS/Firepower, Fortinet IPS, Trend Micro TippingPoint, or open-source tools like Snort, Suricata, and Zeek).
- Protocol Packet Analysis: Strong foundational grasp of the TCP/IP suite, common application protocols (HTTP/S, DNS, DHCP, TLS, SSH), and hands-on skill using packet analysis tools (e.g., Wireshark, tcpdump).
- Signature Rule Logic: Basic understanding of how signature patterns, regular expressions, and protocol anomaly engines detect malicious behavior.
- Operating Systems: Basic to intermediate Linux command-line skills (navigating log files, viewing system resources, editing config files via vi/nano, and running basic network utilities).
- Certifications: Associate-level or foundational security certifications are preferred (e.g., CompTIA Security+, CompTIA Network+, Cisco Certified CyberOps Associate, or vendor-specific associate certifications).
- Soft Skills: Methodical troubleshooting approach, transparent technical writing for documentation, and effective cross-team communication with SOC and network infrastructure groups.

📌 GMS-Staff-IDS Management (Bengaluru)
🏢 EY
📍 Bengaluru