Network Security Engineer เป็นผู้เชี่ยวชาญที่ออกแบบ สร้าง ใช้งาน และดูแลระบบความปลอดภัยเครือข่าย เพื่อปกป้องข้อมูลและโครงสร้างพื้นฐานจากภัยคุกคาม ทำงานที่จุดตัดระหว่าง Networking (Routing, Switching, Protocols) และ Security (Firewall, IPS, VPN, Zero Trust, Cloud Security)
| หมวด | เทคโนโลยี/โซลูชัน | รายละเอียด |
|---|
| Firewall (NGFW) | Palo Alto (Pan-OS), FortiGate (FortiOS), Check Point (Gaia), Cisco Firepower (FTD/ASA), Sophos XGS | App-ID, User-ID, Content-ID (AV, IPS, URL Filtering, File Blocking, SSL Decrypt), HA, Virtual Systems |
| IPS/IDS | Snort, Suricata, Zeek, Vendor IPS | Signature Tuning, Custom Rules, Protocol Anomaly, Encrypted Traffic Analysis |
| VPN / ZTNA | IPsec (IKEv2), SSL VPN, WireGuard, Tailscale, Zscaler ZTNA, Cloudflare Access, Twingate | Site-to-Site, Remote Access, Certificate Auth, MFA Integration, Split Tunnel Policy |
| NAC | Cisco ISE, Aruba ClearPass, FortiNAC, Portnox | 802.1X (EAP-TLS, PEAP, TEAP), MAB, Profiling, Posture, Guest/Contractor, Quarantine |
| DDoS Protection | Arbor, Radware, Cloudflare, AWS Shield, Azure DDoS Protection | On-prem + Cloud Scrubbing, Behavioral Detection, API Integration |
| Email/Web Security | Proofpoint, Mimecast, Cisco ESA, Zscaler, Netskope, Menlo Security | SPF/DKIM/DMARC, Sandbox, Isolation, DLP, CASB |
| Segmentation | VLAN, VXLAN, EVPN, Cisco ACI, VMware NSX, Illumio, Guardicore (AkAMAI) | Microsegmentation, Zero Trust Segmentation, Policy-based |
☁️ Cloud & Hybrid Network Security
- Cloud Networking: AWS (VPC, TGW, GWLB, Security Groups, NACL, Network Firewall, Firewall Manager), Azure (VNet, vWAN, Firewall, NSG, Firewall Manager), GCP (VPC, Firewall Rules, Cloud Armor, Network Intelligence Center)
- Hybrid Connectivity: Direct Connect, ExpressRoute, Cloud Interconnect, IPsec over Internet, SD-WAN (Viptela, Fortinet, Palo Alto, Versa, Cato)
- Cloud-Native Security: CNAPP (Wiz, Orca, Lacework, Prisma Cloud), CSPM, CWPP, CIEM, DSPM, KSPM
- Container/K8s Network Security: Cilium (eBPF), Calico, Istio/Ambient, Network Policies, Service Mesh mTLS
🤖 Automation, Scripting & Infrastructure as Code
- Languages: Python (Netmiko, NAPALM, Nornir, Scrapli, Paramiko), Go (สำหรับ Tool Development), PowerShell (Windows/Exchange/AD), Bash
- IaC: Terraform (Providers: PAN-OS, FortiOS, AWS, Azure, GCP, Cloudflare), Ansible (Network Modules, AVD), Pulumi, CrossPlane
- GitOps: ArgoCD, Flux — Sync Network/ Security Config จาก Git
- CI/CD Security: SAST/DAST/SCA/Container Scan ใน Pipeline, Policy as Code (OPA/Rego, Kyverno, Gatekeeper)
- API/REST/GraphQL/gRPC: Vendor APIs (Palo Alto XML/REST, FortiOS API, Meraki Dashboard API, Cisco DNA Center API)
📊 Monitoring, Detection & Response
- SIEM: Splunk (SPL), Elastic (KQL/DSL), Microsoft Sentinel (KQL), Chronicle, Sumo Logic
- Query Languages: SPL, KQL, Lucene, SQL — ต้องเขียน Query ได้เก่ง
- Threat Hunting: MITRE ATT&CK Mapping, Sigma Rules, YARA, Velociraptor, Osquery
- NDR: Corelight (Zeek), ExtraHop, Vectra AI, Darktrace — Encrypted Traffic Analysis
- SOAR: Cortex XSOAR, Splunk SOAR, Tines, Panther, Shuffle — Playbook Development
ทักษะนุ่ม (Soft Skills) — สำคัญไม่แพ้ Hard Skills
| ทักษะ | รายละเอียด |
|---|
| Analytical & Problem Solving | Root Cause Analysis, Troubleshooting Methodology (OSI Model, Divide & Conquer), Critical Thinking |
| Communication | Technical Writing (Runbooks, RFC, Incident Reports), Stakeholder Presentation, Cross-team Collaboration |
| Project Management | Agile/Scrum, Jira/Confluence, Change Management (ITIL), Risk Assessment, Timeline Estimation |
| Continuous Learning | Certification Roadmap, Lab Practice (EVE-NG, GNS3, CML, Cloud Free Tiers), CTF, Home Lab |
| Security Mindset | Assume Breach, Least Privilege, Defense in Depth, Zero Trust, Threat Modeling (STRIDE, PASTA) |
การศึกษาและใบรับรอง (Education & Certifications)
| ระดับ | ใบรับรอง | เน้น |
|---|
| Foundation | CompTIA Network+, Security+, (ISC)² CC | Networking Basics, Security Fundamentals |
| Associate | CCNA (200-301), CCNA Security (ยุติแล้ว → ใช้ CCNP Security), Fortinet NSE 4, Palo Alto PCCSA | Vendor-specific Network + Security |
| Professional | CCNP Security (SCOR 350-701 + Concentration), CISSP, Palo Alto PCNSE, Fortinet NSE 5/6/7, Check Point CCSE | Advanced Network Security, Architecture |
| Expert | CCIE Security, CISSP-ISSAP/ISSEP, OSCP/OSEP (Offensive), GSE (GIAC Security Expert) | Expert-level Design/Implementation/Offensive |
| Cloud Specialty | AWS Security Specialty, Azure Security Engineer (AZ-500), GCP Cloud Security Engineer | Cloud-Native Security |
หน้าที่ประจำวัน (Day-to-Day Responsibilities)
- ออกแบบและดูแล Firewall Policies, NAT, VPN, Routing, Segmentation
- ตรวจสอบ Alert จาก SIEM/NDR/IPS → Triage, Investigate, Respond
- ทำ Firewall Rule Review / Recertification (Quarterly) — ลบ Rule ไม่ใช้, ลด Attack Surface
- Vulnerability Scanning Network Devices → Remediation Tracking
- Firmware/Software Upgrade Planning & Execution (Maintenance Windows)
- Security Architecture Review สำหรับ Project ใหม่ (Cloud Migration, New App, M&A)
- Automation: เขียน Script/Playbook/Module ลด Manual Work, Enforce Standards
- Documentation: Network Diagrams, Runbooks, Config Standards, HLD/LLD
- Collaboration: NetOps, SecOps, CloudOps, AppDev, Helpdesk, Management
เงินเดือนและตลาดแรงงาน (Thailand / Global)
| ระดับ | Thailand (THB/เดือน) | Global (USD/ปี) |
|---|
| Junior (0-2 ปี) | 45,000 - 70,000 | $60,000 - $90,000 |
| Mid (3-5 ปี) | 70,000 - 120,000 | $90,000 - $140,000 |
| Senior (6-10 ปี) | 120,000 - 200,000+ | $130,000 - $180,000+ |
| Lead/Architect | 180,000 - 300,000+ | $160,000 - $250,000+ |
แนวทางการเตรียมตัว (Roadmap)
- Root: CCNA + Network+ → เข้าใจ Networking จริง (Lab ทุกวัน)
- Security Foundation: Security+ → CISSP (ถ้าอยู่ 5+ ปี) หรือ CCNP Security / PCNSE
- Choose Specialization: Cloud Sec (AWS/Azure), Zero Trust (Zscaler/Cloudflare), Automation (Python/Ansible/Terraform), Threat Hunting (Splunk/Elastic/Sigma)
- Build Home Lab: EVE-NG + vIOS/vSRX/vMX + Palo Alto VM + FortiGate VM + Kali + Elastic Stack
- Contribute: GitHub (Network Automation Scripts, Sigma Rules, Terraform Modules), Blog, CTF
- Network: ThaiCERT, ThaiNSA, ISACA Thailand, (ISC)² Thailand Chapter, Cloud/DevOps Communities
สรุป
Network Security Engineer ต้องเป็น Hybrid Engineer: Networking Guru + Security Architect + Automation Developer + Cloud Practitioner — เรียนรู้ไม่มีวันจบ ต้องสร้าง Home Lab และ Automation Portfolio เพื่อพิสูหน์ความสามารถจริง
