Network Security Engineer

CTI Staffing is partnering with a leading technology organization to find two Network Security Engineers for their Information Security team, based in Foster City, CA. This is a hybrid, 6-month contract-to-hire with three days a week onsite. The team keeps network security systems running and delivers scoped buildout projects, and these engineers do the hands-on work.

- Administer next-gen firewall and UTM platforms, including policy changes, rule cleanup, software and signature updates, and certificate renewals

- Operate URL filtering and Layer-7 inspection policies, including category tuning and exception handling

- Tune IDS/IPS signatures, reduce false positives, and escalate confirmed detections to the security operations team

- Support 802.1X network access control, including supplicant, certificate, and policy troubleshooting and onboarding new device types

- Support remote access VPN, including client troubleshooting, access and split-tunnel policy changes, and availability monitoring

- Work the ticket queue to SLA with clear written updates to requesters

- Maintain runbooks, network diagrams, and configuration documentation

- Deliver scoped projects, including an 802.1X expansion and segmentation with SSL decryption enforcement

Must-Have:

- 5+ years of network security engineering supporting production environments

- 5+ years of IT systems or application engineering and administration

- Strong working knowledge of all layers of the OSI model

- Hands-on Layer-7 protection experience: application control, TLS inspection, IPS, URL and DNS filtering

- Direct experience administering enterprise NGFW/UTM platforms

- Experience implementing and supporting 802.1X wired and wireless NAC

- Experience with enterprise remote access VPN

- Experience working within a formal change management process, with clear written and verbal communication across security, IT, product, and operations teams

- Relevant certifications such as PCNSE, Security+, or CISSP

- Scripting or automation experience for configuration and reporting (Python, Ansible, Terraform)

- Experience in a regulated or safety-critical environment

- Experience with network segmentation and SSL decryption enforcement

- Strong runbook and network diagram documentation habits

- Enterprise NGFW/UTM platforms, URL filtering, and Layer-7 inspection

- IDS/IPS and TLS/SSL decryption

- 802.1X wired and wireless NAC

- Remote access VPN

- ITSM ticketing and formal change management

- Tickets closed to SLA, with satisfied requesters

- Changes land cleanly, with no change-caused incidents

- Project milestones hit on agreed dates, with complete documentation at handoff