Network security engineer

What it answers for

• Policy that expresses the intended boundary rather than an accumulation of exceptions.
• Availability of the controls in the path, which is a network responsibility whatever the org chart says.
• Knowing what would actually be blocked, as distinct from what the policy document claims.

What it is measured on

• Outages attributable to the security path, which is the number this role is judged by unfairly and permanently.
• Rule-base hygiene: exceptions with owners and dates rather than accumulated permits.
• Time to implement a change safely, since a slow path drives teams around the control.

Who else has a stake

• Every application owner whose traffic crosses a boundary this role controls.
• The network team, whose availability numbers absorb this role's mistakes.
• The provider, once part of the boundary moved into their edge.

What it takes

• Genuine networking depth: routing, translation, encryption and the ability to read a capture.
• The discipline to keep a rule base clean when nobody is asking for that.
• Enough diplomacy to be the person who says no, repeatedly, to colleagues.
• Comfort with the fact that success here is invisible and failure is a conference call.

The published sources

• NICCS, CISA - the NICE Workforce Framework for Cybersecurity, which defines the work roles, tasks and skills used across public, private and academic sectors
• NIST Cybersecurity Framework - the Govern, Identify, Protect, Detect, Respond and Recover functions that most security programmes are organised against

Where it leads

• Security engineerWho defends it
• Network operations specialistWho runs it
• Security architectWho defends it
• Network consulting engineerWho deploys it

The work itself

The Practice covers how this work is done — triage, escalation, evidence, handover — across the whole corpus.

• Reading a design you did not writeInheriting a system somebody else designed is one of the most common situations in this work, and the first act is not to judge the design but to recover the constraints it was answering. Almost everything that looks wrong is a decision whose reason has left the building, and the parts that are genuinely wrong are indistinguishable from the parts that are not until you know which is which.
• What acceptance testing is actually forAcceptance testing is not a demonstration that the system works. Its real function is to write down what "working" was agreed to mean, while both parties still want to agree — so that the argument arriving eighteen months later has a document instead of two memories.
• The runbook nobody can follow, and whyRunbooks fail when they are written by the person who least needs them, at the moment they understand the system best, for a reader they imagine to be themselves. The fix is not more detail — it is writing for a specific reader in a specific state, and then letting that reader break it before you need it.
• Handover: the moment a project becomes an operationHandover is treated as a document transfer and is actually a transfer of judgement — and judgement is the one thing that cannot be handed over in a meeting. What can be transferred is the reasoning behind the decisions, the list of things that were left unfinished, and the name of somebody who will answer the phone.
• Baselines — knowing what normal looks like before you need toA baseline is not monitoring and not documentation. It is the answer to the only question that matters in the first ten minutes of an incident — has this always been like that — and it is the one artefact that can only be made when nothing is wrong.
• What a baseline cannot tell youA baseline records what happened during the period it was taken and silently promotes that period's conditions to the status of normal. It answers whether something changed, which is worth having — but it cannot tell you whether the thing it recorded was ever right, and the difference between those two questions is where confident wrong answers come from.
• Change windows, and the arithmetic of a rollbackA change window is not the time the change takes. It is the time the change takes plus the time to discover it went wrong plus the time to put it back — and the third number is the one nobody measures, which is why windows overrun and rollbacks get abandoned halfway.
• Naming, addressing, and the cost of getting them wrong earlyNaming and addressing are decided in an afternoon by whoever is free, and they outlast every other decision in the estate — not because they are technically hard to change, but because everything else quietly comes to depend on them. The cost is paid years later, by somebody else, in a currency nobody budgeted.

Read The Practice