Network Security Engineer, ICE Systems

ICE Systems owns the defensive layer that sits in front of every hall fabric: Barrier at the edge, Ward on the customer boundary, Sentry inside. You will own a tier. Most of the work is tuning against live traffic, because we have never found a lab that reproduces the net at this scale and have stopped funding attempts to build one.

Responsibilities

• Own the Barrier ruleset for two regions, including the weekly promotion cycle and the rollback that follows roughly one promotion in nine.
• Tune Ward thresholds per customer boundary. Customers are not notified of threshold changes and do not have visibility of their own; this is contractual and is not yours to renegotiate.
• Operate Sentry within the hall boundary. Sentry is permitted to act without an operator in the loop inside that boundary; you will review what it did, after it did it, on a two-hour cadence.
• Write the post-action record for every autonomous Sentry action. The record is the only account of the event that exists.
• Carry the defence pager one week in five, paired with Incident Command.
• Retire rules. We add roughly 400 a quarter and remove roughly 40; closing that gap is an explicit objective of this requisition.

Requirements

• Five years operating production network defence at carrier scale, or three with demonstrable fabric-level ownership.
• Fluency in at least one packet-processing pipeline (P4, eBPF/XDP, or a vendor forwarding-plane SDK) and the willingness to read the silicon documentation rather than the marketing.
• Comfort with irreversible actions. A promoted Barrier rule affects 601 MW of contracted load within 40 seconds.
• Ability to write a defensible account of an event in which you were not present and the acting system cannot be interviewed.
• Tier 2 screening on offer, renewed every two years for the duration of employment.

Nice to have

• Experience with deck-side traffic patterns — decks behave unlike anything else on a fabric and the literature is thin.
• Prior exposure to Sentry-class autonomous defence, from either side of it.
• Reading knowledge of pre-2005 routing code. Some of what we run has no living author.

Process

1. Application read by the hiring manager, not by a filter. Five working days.
2. Screening call, 30 minutes, with the recruiter for the team named on the requisition.
3. Technical or desk conversation, 90 minutes, with two people you would work beside.
4. Site visit, half a day, at the facility named on the requisition. You will walk a hall.
5. Offer, with the band, the screening tier and the on-call obligation stated in writing.