Security Operations Engineer

Overview

Hybrid Security Operations Engineer role responsible for Web Application and API Protection (WAAP) administration, acting as technical lead for the platform's administration, optimization, and continuous improvement.

What you'll do

• Administer, maintain, and optimize the WAAP platform, including web application firewall (WAF), API security, bot protection, and DDoS mitigation capabilities.
• Monitor and analyze application traffic to identify, investigate, and mitigate security threats targeting internet-facing applications and APIs.
• Configure, tune, and maintain WAF policies, security rules, signatures, and exceptions to maximize protection while minimizing false positives.
• Partner with application development, infrastructure, and cloud engineering teams to securely onboard and protect new applications and APIs.
• Review security events, alerts, and logs to investigate suspicious activity and support incident response efforts.
• Perform traffic analysis and troubleshooting to resolve application availability, performance, and security issues.
• Conduct security assessments of web applications and APIs and provide recommendations to remediate identified risks and vulnerabilities.
• Develop and maintain operational documentation, standard operating procedures, and configuration standards for WAAP technologies.
• Support the implementation of bot management, account takeover protection, and API security controls to address evolving threats.
• Integrate WAAP technologies with SIEM, SOAR, and other security monitoring platforms to improve visibility and response capabilities.
• Participate in change management processes and perform testing and validation of security policy updates before production deployment.
• Collaborate with security architecture and application security teams to continuously improve the organization's application security posture.

What you'll need

• Proven experience in Web Application Firewall (WAF) / Web Application and API Protection (WAAP) technologies.
• Strong understanding of web application security concepts, including the OWASP Top 10 and common web-based attack techniques.
• Experience analyzing HTTP/S traffic, web application logs, and security events.
• Experience working with API technologies, including REST, JSON, OAuth, JWT, and API authentication mechanisms.
• Experience supporting security monitoring, threat detection, incident response, or vulnerability management activities.
• Expertise in Application Security, WAF administration, API Security, and Networking.
• Strong communication skills to explain complex technical issues clearly to non-technical audiences.

Nice to have

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent professional experience.
• 6+ years of cybersecurity experience, with a focus on web application security, network security, and cybersecurity engineering functions.
• Experience administering Imperva WAAP, Imperva WAF, or other enterprise WAAP solutions.
• Experience with cloud platforms such as AWS, Azure, or Google Cloud.
• Experience with bot mitigation, API security, and DDoS protection technologies.
• Experience with scripting or automation using Python, PowerShell, or REST APIs.
• Industry certifications such as CISSP, Security+, GSEC, GWAPT, CCSP, AZ-500, or AWS Security Specialty.

Details

• Hybrid role with a requirement to work on average 2 days per week from an HPE office.
• Location: Bengaluru, Karnātaka, India.
• Job level: TCP_04; job family: Information Technology.