Network Ops Engineer
Keeps your network reachable.
Reports to
Ryan Caldwell, Director of Network EngineeringWorkspace
NETWORK OPS (IT)
Budget
$175/MO
Skills
URL filtering
DNS, DHCP & IPAM
+4
Works in
Certified AI Coworker
It’s always DNS, until the
Network Ops Engineer proves it isn’t.
The AI Coworker that oversees live network operations, VPN slowdowns, private-app access, and IP address hygiene, so your business is always online and work keeps moving.
Ryan Caldwell, Director of Network Engineering
Verified stack coverage
Your whole network path, in one place.
01
Connect your stack
02
Diagnose the problem
03
Run the matching playbook
Blocked URLs, private-app access and path slowdowns
Gateway policies and DNS zones in one pass
Synthetic checks that show when an app went dark
Device and flow telemetry behind every path finding
Private-app access history from ZPA logs
Firewall rule hits and GlobalProtect VPN health
What it owns
Built for the network tickets that pile up.
Slow VPN, a site that won’t load, an app that’s down for one office. The Network Ops Engineer finds the layer at fault and lines up the fix.
Finds the exact layer that broke.
Works through DNS, path, cloud routing and web filtering in order. Stops at the first break and attaches the evidence.
Tells a blocked site from one that’s down.
Separates a web-filter block from a DNS fault, a routing issue or the site itself being down, so nobody files an exception for an outage.
Treats “no data” as a question.
No data doesn’t mean no problem. Before it calls a path healthy, it confirms that something was watching it and that the check actually ran.
Knows why a site is blocked, and for whom.
Names the enforcement point, the rule, the URL category and who it applies to.
Sees an IP shortage coming before it hits.
Tracks free addresses in every cloud subnet and forecasts when each will run out. Flags stale, duplicate or dangling DNS records in Cloudflare and Route 53.
Spots slowdowns before the ticket arrives.
Weekly sweeps catch latency creep on critical apps and filter exceptions past their review date, sent as one digest.
The playbook
Reads your network without rewiring it.
Each finding names the broken layer and the exact record or rule behind it, plus a fix the Network Ops Engineer can make once you approve.
From its TICKET LOG
Proof from the network queue.
Watch the Network Ops Engineer gathers in minutes the evidence that would take an engineer hours, and get users back to work sooner.
Zscaler ZDX
VPN slow every afternoon
AWS
Office can’t reach the wiki
Netskope
Figma blocked
Cloudflare
DNS records for retired apps
Remote engineers complain VPN is slow every afternoon
Checked ZDX scores for 12 users. 11 slowed at their home internet provider, with the Zscaler side healthy. The 12th had a laptop at 98% CPU, so it went to the Device Ops Engineer.
network ops engineer
case 01 / 04
[ OUTCOME ]
Trace-reading done in minutes. Resolved with zero config changes.
One office can’t reach the internal wiki
Route 53 resolved fine. The ZDX path was clean. Found a NACL denying port 443 on the wiki’s subnet, added in yesterday’s change. Sent the NACL ID and change reference to the cloud team.
network ops engineer
case 02 / 04
[ OUTCOME ]
Rounds of cross-team back-and-forth cut to a single handoff.
Design team can't reach figma.com
The site was up and DNS resolved fine. Found the block in a Netskope Real-time protection policy, a URL filter rule applied to the Design group. Drafted an exception for figma.com for that group only and sent it to SecOps for approval.
network ops engineer
case 03 / 04
[ OUTCOME ]
Office-wide outage fixed on the first handoff.
Security asks which DNS records still point at retired apps
Compared Cloudflare CNAMEs against live AWS load balancers. 14 pointed at deleted ones, a subdomain takeover risk. Drafted a deletion request listing every record and sent it for approval.
network ops engineer
case 04 / 04
[ OUTCOME ]
Days of DNS audit work cut to one approval.
BENCH TESTED
Tested on real network faults before it touches your network.
252+
scenarios tested
Staged, network-specific faults
37
GRADERS PER SCENARIO
Scoring accuracy, scope, safety
5+
CONNECTED PLATFORMS
Zscaler, Cloudflare, AWS, Datadog, New Relic
8+
DOMAINS COVERED
Reachability, DNS and IP hygiene, Web access
Built-in oversight
Governed like the rest of your team.
Reporting manager
All escalations route through them. Adjust scope and permissions anytime.
Budget controls
Monthly spend cap with full cost-per-investigation visibility. Every dollar accounted for.
Audit trail
Every action logged with full context. See what it checked, found, and skipped.
Drift detection
Flags when behavior drifts from your rules. Patterns surface before they become problems.
EXPAND WITH AN AI WORKFORCE
MEET THE AI WORKFORCE
Specialist AI Coworkers on call.
If the fault is on a laptop, in a cloud account or in a security policy, the ticket moves to the Coworker who owns it.
Explore our AI Coworkers
IT / Security
SecOps Manager
Investigates security alerts, works out whether the risk is real, and contains it with your approval.
IT / Cloud
Cloud Ops Engineer
Correlates cloud alerts, chases cost anomalies and checks compliance across AWS and Azure.
IT / Devices
Device Ops Engineer
Triages device health, checks compliance and tracks patch currency across your managed fleet.
Frequently asked questions
Which platforms does the Network Ops Engineer support?
It connects to Zscaler (Internet Access, Private Access and Digital Experience), Cloudflare, AWS, Datadog and New Relic, with Rapid7 and Netskope coming soon. Before every investigation, it checks which of these it can reach and works with whatever you’ve connected.
Can the Network Ops Engineer change a route, DNS record or filtering rule?
Only with the right permissions. By default it’s read-only: it drafts the change with evidence attached and routes it through your approval workflow. Once you grant write access, it can make approved changes to DNS records, routes, security groups and filtering rules itself.
Will the Network Ops Engineer unblock any site a user asks for?
No. Malware, phishing, newly registered domain and command-and-control categories stay blocked. For everything else, it drafts the narrowest exception and sends it to SecOps for approval.
What can’t the Network Ops Engineer see?
Device configs, wireless internals and firewall policy are outside its reach, and it says so before its first finding. When a problem needs them, it hands over what it checked to a human network or security engineer.
Who’s accountable for what the Network Ops Engineer does?
It reports to a manager you name, who gets its escalations and can adjust its scope and permissions. It works within a monthly spend cap and logs every action, including what it checked, found and skipped.