L2 Security Engineer – Perimeter Security

Incident Response & Containment

• Take ownership of validated security incidents escalated from L1 teams.
• Execute containment actions as per approved SOPs, including:
  • Malicious IP blocking
  • Firewall policy enforcement
  • Traffic mitigation
• Coordinate real-time response during active cyber-attacks.
• Ensure service restoration and post-incident stability.

Perimeter Security Operations

Firewalls (Cisco, Palo Alto, Check Point, Fortinet)

• Implement approved temporary security rules.
• Support emergency firewall and access control changes.
• Troubleshoot firewall-related incidents and policy issues.

IDS / IPS (Trend Micro, Cisco)

• Validate exploit attempts and security alerts.
• Apply temporary signature tuning during incidents.
• Monitor intrusion detection and prevention effectiveness.

DDoS Protection (ISP, Radware)

• Activate mitigation techniques during DDoS attacks.
• Coordinate with ISPs and SOC partners for attack mitigation.
• Monitor attack traffic and ensure service continuity.

Web Application Firewall (F5)

• Apply temporary mitigation and blocking rules.
• Protect web applications against malicious traffic and attacks.
• Support WAF policy optimization.

Proxy & Internet Security

• Investigate suspicious internet traffic.
• Contain infected endpoints and malicious communications.
• Monitor secure web gateway activities.

Micro-Segmentation (GuardiCore)

• Apply containment policies to prevent lateral movement.
• Support network segmentation during security incidents.
• Assist in policy implementation and validation.

Root Cause Analysis & Reporting

• Perform detailed Root Cause Analysis (RCA) for security incidents.
• Prepare technical and executive-level incident reports.
• Support audit, compliance, and security evidence collection.
• Coordinate with OEM TAC and internal Subject Matter Experts (SMEs) for complex issues.