Network Security Engineer, ADC Security

What You’ll Do

As a network security engineer focused on ADC Security, you will drive improvements in identity outcomes across the network for AWS. Your work centers on network detection, incident triage, and automated detection-as-code, supported by IAM-related security expertise.

• Author, tune, and maintain network detection content to support high-fidelity coverage with low false-positive rates.
• Triage and investigate security incidents, driving them through to resolution across the operational network.
• Build and operate detection-as-code pipelines, including IDS/IPS and syslog-based rule engines.
• Apply AI/ML-powered anomaly detection and alert prioritization to automate and improve triage.
• Integrate threat intelligence and perform forensic and root-cause analysis.
• Establish and track operational metrics for detection coverage, on-call health, and incident response readiness.
• Partner with other Infrastructure Security teams to close detection gaps and reduce mean-time-to-detect and mean-time-to-respond.

A Day in the Life

• Review overnight alerts from IDS/IPS and syslog rule engines, separate signal from noise, and open investigations into anomalies flagged by ML models.
• Pull network telemetry and forensic data to determine root cause, then drive incidents through to resolution.
• Tune a noisy detection rule as code, push it through the pipeline, and integrate a new threat-intelligence feed.
• Update detection-coverage metrics and coordinate with a neighboring Infrastructure Security team to close a gap, helping keep a classified network defensible around the clock.

Requirements

• Bachelor’s degree, or one of the following: CCSP (Certified Cloud Security Professional), CEH (Certified Ethical Hacker), CFR (CyberSec First Responder), Cloud+, CySA+ (CompTIA Cybersecurity Analyst), GCED (GIAC Certified Enterprise Defender), GICSP (Global Industrial Cyber Security Professional), or PenTest+
• 3+ years of non-internship experience troubleshooting systems issues, analyzing logs, or automating basic tasks using command line tools
• Knowledge of networking protocols, including HTTP(S), DNS, and TCP/IP
• Current, active US Government Security Clearance of TS/SCI with Polygraph
• US Citizenship

Technologies You’ll Work With

• IDS/IPS
• syslog
• AI/ML
• HTTP(S)
• DNS
• TCP/IP

Diverse Experiences

Even if you do not meet all of the qualifications and skills listed in the job description, you are encouraged to apply.

Preferred Qualifications

• Experience applying threat modeling or other risk identification techniques or equivalent
• Experience with security in service-oriented architectures/microservices and web services