About the job
Join our dynamic cybersecurity team as a Network Intrusion Detection Engineer, where your expertise will be pivotal in protecting our network infrastructure. We are looking for a talented individual with robust Linux engineering skills and a deep understanding of YAML configuration files, specifically how they interface with Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS). The ideal candidate will have practical experience working with Suricata and similar network-based IDS solutions like Snort, VectraAI, or Corelight. In this role, you will be instrumental in deploying, optimizing, and maintaining IDS within a sophisticated enterprise IT environment, primarily utilizing Red Hat Enterprise Linux.
Key Responsibilities:
- Design, deploy, and maintain IDS/IPS systems across a multifaceted enterprise environment.
- Develop and refine YAML configuration files to maximize detection efficacy while minimizing false positives.
- Manage the interaction between YAML configurations and runtime engines, focusing on rule loading, protocol decoding, and logging functionalities.
- Tune IDS/IPS for peak performance, including NIC configuration for Direct Memory Access (DMA), Receive Side Scaling (RSS), and other acceleration techniques.
- Collaborate with security teams to seamlessly integrate IDS/IPS solutions with SIEM and other security monitoring tools.
- Address installation and operational challenges specific to IDS/IPS on Red Hat Enterprise Linux, including compatibility issues, kernel module requirements, SE-Linux policies, and performance tuning.
- Identify and resolve common challenges faced when deploying IDS/IPS in large-scale enterprise settings, such as package dependencies and resource constraints.
- Document detailed runbooks for Suricata configuration and NIC tuning processes.
- Keep abreast of the latest software releases, NIC driver updates, and industry best practices for enhancing IDS/IPS performance.
