Network Security Engineer

About This Opportunity

CTI Staffing is partnering with a leading technology organization to find two Network Security Engineers for their Information Security team, based in Foster City, CA. This is a hybrid, 6-month contract-to-hire with three days a week onsite. The team keeps network security systems running and delivers scoped buildout projects, and these engineers do the hands-on work.

What You'll Do

• Administer next-gen firewall and UTM platforms, including policy changes, rule cleanup, software and signature updates, and certificate renewals
• Operate URL filtering and Layer-7 inspection policies, including category tuning and exception handling
• Tune IDS/IPS signatures, reduce false positives, and escalate confirmed detections to the security operations team
• Support 802.1X network access control, including supplicant, certificate, and policy troubleshooting and onboarding new device types
• Support remote access VPN, including client troubleshooting, access and split-tunnel policy changes, and availability monitoring
• Work the ticket queue to SLA with clear written updates to requesters
• Maintain runbooks, network diagrams, and configuration documentation
• Deliver scoped projects, including an 802.1X expansion and segmentation with SSL decryption enforcement

Requirements

What You Bring

Must-Have:

• 5+ years of network security engineering supporting production environments
• 5+ years of IT systems or application engineering and administration
• Strong working knowledge of all layers of the OSI model
• Hands-on Layer-7 protection experience: application control, TLS inspection, IPS, URL and DNS filtering
• Direct experience administering enterprise NGFW/UTM platforms
• Experience implementing and supporting 802.1X wired and wireless NAC
• Experience with enterprise remote access VPN
• Experience working within a formal change management process, with clear written and verbal communication across security, IT, product, and operations teams

Nice-to-Have:

• Relevant certifications such as PCNSE, Security+, or CISSP
• Scripting or automation experience for configuration and reporting (Python, Ansible, Terraform)
• Experience in a regulated or safety-critical environment
• Experience with network segmentation and SSL decryption enforcement
• Strong runbook and network diagram documentation habits

Technical Environment:

• Enterprise NGFW/UTM platforms, URL filtering, and Layer-7 inspection
• IDS/IPS and TLS/SSL decryption
• 802.1X wired and wireless NAC
• Remote access VPN
• ITSM ticketing and formal change management

What Success Looks Like:

• Tickets closed to SLA, with satisfied requesters
• Changes land cleanly, with no change-caused incidents
• Project milestones hit on agreed dates, with complete documentation at handoff