Network Security Engineer - IDS/IPS

Ernst & Young LLP ( EY India ); Bengaluru; On-site; INR 900,000 - 1,300,000; Full time

Job summary

EY in India is seeking a Junior to Staff-level Network Security Engineer specializing in IDS/IPS. You will support the full lifecycle of sensors, from assess to operations, collaborating with SOC teams and security operations.

Strongs skills in packet analysis and signature tuning are required. The role involves deploying and validating sensors (Snort/Suricata/Zeek), configuring log forwarding to SIEM, and maintaining high availability across enterprise networks.

Qualifications

• Experience in network security operations and IDS/IPS administration (1–3 years).
• Familiarity with enterprise IDS/IPS solutions (Snort, Suricata, Zeek, or equivalent).
• Strong TCP/IP and protocol analysis skills; basic Linux command line proficiency.

Responsibilities

• Assess posture and sensor placements; review threat intel and CVEs to close coverage gaps.
• Support deployment, configuration and integration of IDS/IPS sensors and log forwarding to SIEM.
• Document architectures, IP allocations and change workflows; assist in maintenance windows.

Skills

IDS/IPS ops

Network security

Packet analysis

Linux CLI

Signature tuning

Tools

Snort

Suricata

Zeek

Splunk

Wireshark

Job description

GMS-Staff-IDS Management At EY, you'll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we're counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all.

Network Security Engineer - IDS/IPS (Staff / Junior Level) Experience Level: 1-3 Years

Role Overview

We are looking for a Junior to Staff-level Network Security Engineer specializing in Intrusion Detection and Prevention Systems (IDS/IPS). Working closely with senior architects and security operations teams, this individual will support the end-to-end lifecycle of our IDS/IPS sensors- spanning Assess, Build, Transition, and Operations. The ideal candidate has a strong foundation in network protocols, traffic analysis, and alert triage, with a keen interest in signature tuning, vulnerability detection, and maintaining high sensor availability across enterprise environments.

Key Responsibilities

• Assess (Posture Review & Signature Evaluation) Assist in evaluating existing network tap/SPAN port configurations and sensor placements to ensure complete visibility across critical network segments. Review vendor threat intelligence feeds, CVE releases, and security advisories to assess coverage gaps against emerging network attack vectors. Audit current IDS signature sets and inspection policies to identify noisy, legacy, or deprecated rules causing excessive false positives. Document sensor hardware/software versions, throughput metrics, and interface utilization to support capacity planning.
• Build (Deployment, Baseline & Integration) Support the installation, initial configuration, and staging of physical and virtual IDS/IPS appliances or software agents (e.g., Snort, Suricata, Zeek, or commercial NGFW threat engines). Apply baseline inspection policies, protocol anomaly detection rules, and preprocessor settings in line with internal security standards. Validate tap/SPAN aggregation, packet broker feeds, and interface cabling to ensure zero packet drop during traffic ingestion. Configure log forwarding and telemetry streaming to the central SIEM/data lake (e.g., Splunk, Microsoft Sentinel) via Syslog, JSON, or dedicated API connectors.
• Transition (Testing, Handover & Documentation) Conduct synthetic traffic generation and controlled attack simulations (e.g., using test replay tools or benign exploit scripts) to verify detection accuracy before production cutover. Assist in drafting standard operating procedures (SOPs), alert escalation workflows, and initial triage playbooks for Level 1 SOC analysts. Document "As-Deployed" sensor architectures, IP allocation tables, tap mappings, and management interface credentials in the team knowledge base. Participate in maintenance window cutovers, executing pre- and post-validation checklists.
• Operations & Continuous Management Monitor IDS/IPS health, disk usage, memory utilization, and inspection latency; raise service tickets for degraded hardware or dropped packets. Perform daily triage of IDS alerts and assist SOC teams in analyzing raw packet captures (PCAP) to distinguish true attacks from benign network anomalies. Execute continuous rule-tuning workflows: refine thresholds, create source/destination whitelists, and suppress verified false positives to maintain high alert fidelity. Schedule and apply regular signature feed updates, emergency vulnerability signatures, and minor vendor engine patches. Maintain metric trackers covering weekly detection counts, top triggered signatures, and tuning changes for operational reporting. Understanding of ITIL-based Change Management, managing end-to-end change lifecycle activities, CAB coordination, and compliant implementation of infrastructure and application changes.

Required Skills & Qualifications

• Experience: 1-3 years of hands-on experience in network security operations, IDS/IPS administration, or SOC/tier-2 alert triage.
• Core Technologies: Familiarity with at least one enterprise IDS/IPS solution (commercial engines such as Palo Alto Threat Prevention, Cisco Secure IPS/Firepower, Fortinet IPS, Trend Micro TippingPoint, or open-source tools like Snort, Suricata, and Zeek).
• Protocol & Packet Analysis: Strong foundational grasp of the TCP/IP suite, common application protocols (HTTP/S, DNS, DHCP, TLS, SSH), and hands-on skill using packet analysis tools (e.g., Wireshark, tcpdump).
• Signature & Rule Logic: Basic understanding of how signature patterns, regular expressions, and protocol anomaly engines detect malicious behavior.
• Operating Systems: Basic to intermediate Linux command-line skills (navigating log files, viewing system resources, editing config files via vi/nano, and running basic network utilities).
• Certifications: Associate-level or foundational security certifications are preferred (e.g., CompTIA Security+, CompTIA Network+, Cisco Certified CyberOps Associate, or vendor-specific associate certifications).
• Soft Skills: Methodical troubleshooting approach, clear technical writing for documentation, and effective cross-team communication with SOC and network infrastructure groups.

EY | Building a better working world EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets. Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate. Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today.