While mentioning the options for the service account that sql agent runs under, it bears mentioning that it is strongly recommended to use a named account in the domain to run the service. While the network services account has some limited network privileges, it is impossible to assign explicit permissions to the Network Services internal account. So if you do need to run ETL pulling data from a fileshare, or do anything that involves touching a networked resource, you will probably hit a brick wall with the Network Services account.