Skip to main content
IMMUNITYSEC

Network Security Engineer

Network security engineers design, deploy, and manage the controls that protect an organization's networks, such as firewalls, intrusion detection and prevention systems, VPNs, network access control, and web filtering. NIST guidance for this work covers firewall policies and rulesets as well as newer network designs such as microsegmentation and zero trust network access.

Updated

Career track
Network Security
Certifications
3 listed
Also called
Network security specialist

What They Do

11 tasks
  • Create a firewall policy that defines how firewalls handle inbound and outbound traffic, based on a risk analysis of the traffic the organization needs.
  • Write firewall rulesets that implement the policy, keep each rule as specific as possible, and block traffic the policy does not expressly permit.
  • Select, configure, test, deploy, and manage firewall solutions, and decide where in the network each firewall sits.
  • Manage firewall ruleset changes through a formal change management process, review or test rulesets periodically, and patch firewall software as vendors release updates.
  • Monitor firewall performance, logs, and alerts to identify threats and resource issues.
  • Administer VPN devices and manage network access control lists on specialized cyber defense systems.
  • Install and implement dedicated cyber defense hardware, systems, and tools, and administer their rule and signature updates.
  • Engineer network security technologies such as intrusion prevention, web filtering, SSL decryption, DNS, network access control, and remote access VPN.
  • Design secure connections from the organization's networks to commercial cloud service providers.
  • Divide internal networks into isolated segments so that traffic in and out of each segment can be monitored and controlled.
  • Assess systems and networks for deviations from acceptable configurations and policy, and measure how effective the defense-in-depth architecture is against known vulnerabilities.

Knowledge and Skills

  • Firewall types and their capabilities to analyze network traffic and allow or block it against policy
  • Network security architecture concepts, including topology, protocols, components, and defense-in-depth
  • How traffic flows across the network, including TCP/IP and the OSI model
  • Network attacks and their relationship to threats and vulnerabilities
  • Intrusion detection and prevention system (IDS/IPS) tools and techniques
  • Network access control (NAC) and host access control systems
  • VPN systems and web filtering systems
  • Hardening tools and techniques
  • Zero trust network access (ZTNA) through microsegmentation and software-defined perimeter, and secure access service edge (SASE)

How to Become a Network Security Engineer

CompTIA describes the network security specialist, a role that can carry the network security engineer title, as a mid-level position that typically requires 2 to 3 years of experience working in networking systems. It lists knowledge of network access control systems, firewalls, routers, intrusion prevention systems, incident response techniques, authentication protocols, and attack types.

NIST SP 800-41, the NIST guide to firewalls and firewall policy, is written for technical IT staff such as network, security, and system engineers and administrators who are responsible for firewall design, selection, deployment, and management. It assumes some basic knowledge of networking and network security.

CISA's Network Operations Specialist work role, whose alternative titles include network administrator and network engineer, lists skill in configuring and using network protection components such as firewalls, VPNs, and network intrusion detection systems, and skill in securing network communications.

CompTIA points people toward its Network+, Security+, and PenTest+ certifications for this path. It describes CompTIA Network+ as teaching the skills to begin a career in IT infrastructure and CompTIA Security+ as validating the baseline skills to perform core security functions.

Certifications

3 certifications

These are certifications that the sources on this page name for the role, as described in the FAQ.

Certification
Network+
CompTIA Network+ · CompTIA
Security+
CompTIA Security+ · CompTIA
PenTest+
CompTIA PenTest+ · CompTIA

Frequently Asked Questions

What does a network security engineer do?→

A network security engineer sets up and manages the controls that protect an organization's networks. Typical work includes writing firewall policies and rulesets, engineering intrusion prevention, web filtering, network access control, and remote access VPN, monitoring firewall logs and alerts, and segmenting internal networks so traffic between segments can be monitored and controlled.

How do I become a network security engineer?→

CompTIA describes network security specialist roles, which can carry the network security engineer title, as mid-level positions that typically require 2 to 3 years of experience working in networking systems. NIST SP 800-41 assumes basic knowledge of networking and network security in the engineers and administrators who design and manage firewalls.

What is the difference between a network engineer and a network security engineer?→

CISA lists the two titles under different work roles. Network engineer is an alternative title for the Network Operations Specialist work role (DCWF code 441), which plans, implements, and operates network services and systems. Network security engineer is an alternative title for the Vulnerability Assessment Analyst work role (DCWF code 541), which assesses systems and networks for deviations from acceptable configurations and policy.

What skills does a network security engineer need?→

CompTIA lists knowledge of network access control systems, firewalls, routers, intrusion prevention systems, incident response techniques, authentication protocols, and attack types. CISA's Vulnerability Assessment Analyst work role, which lists network security engineer as an alternative title, includes knowledge of network security architecture and defense-in-depth and of how traffic flows across the network.

What certifications are there for network security engineers?→

For network security specialist roles, CompTIA points to its CompTIA Network+, CompTIA Security+, and CompTIA PenTest+ certifications.

What is microsegmentation in network security?→

NIST SP 800-215 defines microsegmentation as a security design practice that divides an internal network, such as a data center or cloud provider region, into isolated segments so that traffic in and out of each segment can be monitored and controlled. Its primary purpose is isolation that prevents attack escalation. Microsegmentation and software-defined perimeter are the two established network configuration techniques for zero trust network access.

Role descriptions follow the sources listed above: U.S. government workforce data first, then standards bodies and, where named in the text, certification issuers. This site is not affiliated with CISA, the Department of Labor, or the Department of Defense.