Job Summary

Job Summary

We are looking for an experienced L2 Network Security Engineer to manage and support Network Access Control (NAC), Intrusion Prevention Systems (IPS), and DDoS protection solutions in a large enterprise environment.

The candidate will be responsible for day-to-day operations, incident handling, troubleshooting, security policy administration, monitoring, and coordination with OEM, Network, Firewall, SOC, and other infrastructure teams.

Key Responsibilities

NAC – Network Access Control

• Provide L2 operational support for NAC infrastructure and authentication services.
• Troubleshoot 802.1X, MAB, RADIUS, TACACS+, EAP, PEAP and certificate-related issues.
• Analyze endpoint authentication and authorization failures.
• Troubleshoot Cisco ISE policies, identity sources, profiling, posture, and guest access.
• Support integration with switches, wireless controllers, Active Directory, PKI, DHCP, DNS, and endpoint security platforms.
• Investigate authentication failures, endpoint onboarding issues, VLAN assignment issues, and authorization policy problems.
• Perform policy changes and configuration updates based on approved change requests.
• Support NAC upgrades, patching, node health checks, backup and restoration activities.
• Coordinate with Network and EUC teams for endpoint and switch-side troubleshooting.

IPS – Intrusion Prevention System

• Provide L2 support for enterprise IPS infrastructure and security policies.
• Monitor IPS alerts, events, signature matches, false positives, and suspicious traffic.
• Perform troubleshooting for IPS blocking, packet drops, signature-related issues, and traffic anomalies.
• Support IPS policy tuning and rule/signature optimization to reduce false positives.
• Analyze traffic captures, logs, and event information during security incidents.
• Perform signature updates, policy updates, health checks, and configuration changes.
• Support HA/failover testing and troubleshooting.
• Coordinate with OEM/TAC for complex product issues and prepare required troubleshooting data.
• Validate IPS changes through testing and post-change monitoring.

DDoS Protection

• Provide L2 support for on-premise and/or cloud-based DDoS protection solutions.
• Monitor DDoS alerts, traffic anomalies, attack patterns, and mitigation status.
• Support analysis of volumetric, protocol, and application-layer attack events.
• Troubleshoot DDoS mitigation, traffic diversion, routing, and failover-related issues.
• Coordinate with ISP/carrier, Network, SOC, and OEM teams during DDoS incidents.
• Support DDoS protection policy configuration, threshold tuning, and health checks.
• Participate in DDoS simulation, failover, and BCP/DR validation activities.
• Prepare incident reports and support RCA activities following security events.

Incident & Operations Responsibilities

• Handle incidents, service requests, and change requests within the defined SLA.
• Perform incident troubleshooting and provide technical RCA for recurring issues.
• Monitor security infrastructure health and proactively identify potential service degradation.
• Escalate complex issues to L3/OEM teams with complete troubleshooting evidence.
• Participate in 24x7 rotational support/on-call activities, where applicable.
• Maintain operational documentation, troubleshooting guides, and knowledge articles.
• Follow ITIL processes for Incident, Problem, Change, and Service Request management.

Skill Requirements

• Strong hands-on experience in Cisco ISE / NAC.
• Good knowledge of 802.1X, MAB, RADIUS, TACACS+, EAP, LDAP/AD and PKI.
• Strong understanding of enterprise switching and network fundamentals:
• VLAN
• Trunking
• STP
• DHCP
• DNS
• ARP
• Routing
• TCP/IP
• Experience with enterprise IPS/IDS technologies.
• Knowledge of IPS signatures, policies, packet inspection, event analysis, and troubleshooting.
• Good understanding of DDoS attack types and mitigation mechanisms.
• Experience with traffic analysis using Wireshark, packet captures, syslog and security logs.
• Knowledge of High Availability, failover, redundancy and DR concepts.
• Understanding of security monitoring and SIEM integration.

NAC

• Cisco ISE

IPS

• Trend Micro/Trellix
• NGFW -IPS

Other Requirements