Join EY and build a career that's as unique as you are, leveraging global scale, support, and an inclusive culture. We are seeking a Network Security Engineer, specializing in Intrusion Detection and Prevention Systems (IDS/IPS), for a Junior to Staff level position. This role involves supporting the complete lifecycle of our IDS/IPS sensors, from assessment and deployment to transition and ongoing operations. The ideal candidate will possess a strong understanding of network protocols, traffic analysis, and alert triage, with a passion for refining signatures, identifying vulnerabilities, and ensuring high sensor availability.

This position offers the opportunity to work closely with senior architects and security operations teams. You will contribute to maintaining a robust security posture by managing and optimizing our network security infrastructure. EY is committed to fostering an environment where your unique perspective is valued, helping us build a better working world for everyone.

Key responsibilities include evaluating network tap and SPAN port configurations, reviewing threat intelligence for coverage gaps, and auditing IDS signatures to minimize false positives. You will support the deployment and integration of IDS/IPS appliances, applying baseline policies and validating traffic feeds.

Transitioning involves conducting simulations to verify detection accuracy and assisting in the creation of standard operating procedures and triage playbooks. Operations and continuous management require monitoring sensor health, performing alert triage, analyzing packet captures, and executing rule-tuning workflows. This includes scheduling signature updates, applying patches, and maintaining metric trackers for reporting. Understanding ITIL-based Change Management is also essential.

We require 1-3 years of hands-on experience in network security operations, IDS/IPS administration, or SOC alert triage. A strong foundation in TCP/IP, common application protocols, and proficiency with packet analysis tools like Wireshark is essential.

Familiarity with enterprise IDS/IPS solutions (commercial or open-source like Snort, Suricata, Zeek) is necessary, along with a basic understanding of signature logic and regular expressions. Intermediate Linux command-line skills are required for managing log files and system resources. Associate-level security certifications are preferred. Excellent troubleshooting, technical writing, and cross-team communication skills are also vital.