Senior Network Security Engineer

Designing and implementing complex security policies (App-ID, User-ID), configuring VPNs (GlobalProtect), tuning Threat Prevention profiles, and leading firewall migrations/upgrades. You're the go-to person for firewall issues.

Writing advanced SPL/KQL queries, building custom dashboards and alerts, onboarding new log sources, and tuning the system to reduce false positives. You'll be extracting insights from mountains of log data.

Writing and tuning custom Snort/Suricata rules. Independently using Wireshark to perform deep packet inspection, reconstruct sessions, and identify malicious traffic patterns. You're the one who can find the needle in the haystack.

Managing the entire vulnerability lifecycle for network devices. Prioritising vulnerabilities based on business context, validating findings, and working with system owners to architect remediation plans. You're making sure we fix what actually matters first.

Conducting host-level investigations ('threat hunting') using EDR query languages. Analyzing process trees and network connections to determine the full scope of a compromise, especially when a network threat lands on an endpoint.

Investigating complex cloud threats using services like GuardDuty. Writing custom rules to detect specific misconfigurations. Helping application teams implement secure cloud networking (VPCs, Security Groups) and ensuring our cloud footprint is secure.

• Infrastructure and Operations Teams (they build and run the networks you secure)
• Application Development Teams (they build the apps that run on your network)
• Security Operations Centre (SOC) Analysts (they're the first line, you're the escalation point)
• Internal Audit and Compliance (they check your homework)
• Project Managers (they'll want to know when things are done)

• Security Vendors (Palo Alto, Splunk, CrowdStrike – you'll work with their support teams)
• External Auditors (they'll poke holes in your defences)
• Managed Security Service Providers (MSSP) if we use one

Automated tools are good, but sophisticated attackers will always find ways around them. We need engineers who can proactively hunt for threats, understand adversary tactics, and even emulate attacks to test our defences.

MITRE ATT&CK framework for TTPs · Developing custom threat hunting queries (SIEM, ED · Understanding red team methodologies · Memory forensics and malware analysis basics · Proactive identification of lateral movement techn

• This week: Familiarise yourself deeply with the MITRE ATT&CK framework.
• This month: Practice writing complex SIEM queries to detect specific ATT&CK techniques.
• Month 2: Set up a small lab and try to replicate a known attack (e.g., using Metasploit) to see how your tools detect it.
• Month 3: Read a book on threat hunting or adversary emulation.

Quick win: Start subscribing to threat intelligence feeds and blogs that detail new attack techniques. Try to imagine how you'd detect them in your current environment.

The sheer volume of security alerts and tasks means manual processes are no longer sustainable. Automating repetitive tasks and orchestrating complex incident response workflows is critical for efficiency and speed.

Playbook development for common incidents · Integration with various security tools (SIEM, EDR · Automated enrichment of alerts (threat intel, vuln · Low-code/no-code automation platforms · Error handling and logging in automation workflows

• This week: Research common SOAR platforms (e.g., Splunk SOAR, Palo Alto XSOAR).
• This month: Identify one repetitive task you do daily and try to script a basic automation for it (e.g., fetching IP reputation).
• Month 2: Explore how a SOAR platform could integrate with our existing tools.
• Month 3: Map out a simple incident response playbook and consider how it could be automated.

Quick win: Learn a scripting language like Python. Even basic scripting skills will open up huge automation possibilities.