Staff Web Security Engineer

Overview

Staff Web Security Engineer on Coupang's Detection Operations team, protecting the company's global attack surface across web, network, email and endpoint security.

What you'll do

• Design, deploy and manage security controls that protect externally facing web and API services from a wide range of cyber threats using industry-leading security platforms and services.
• Analyze and tune Web Application Firewall (WAF) detections to reduce false positives and false negatives, improve security coverage, deploy security policies, and respond to emerging vulnerabilities and CVEs.
• Detect and mitigate automated and malicious bot activity, continuously improving detection logic, policy effectiveness, and overall bot defense capabilities.
• Strengthen detection and mitigation capabilities against Distributed Denial-of-Service (DDoS) attacks through continuous monitoring, analysis, and policy optimization.
• Conduct proactive web threat hunting activities to identify emerging attack patterns, strengthen detection capabilities, and improve preventive controls.
• Develop and maintain operational procedures, documentation, and automation workflows to increase efficiency and scalability across security operations.
• Analyze API security events and continuously improve detection, investigation, and response workflows to enhance API security posture.
• Perform large-scale analysis of SIEM, security telemetry, and web access logs to identify trends, investigate incidents, and provide actionable security insights through reports and metrics.
• Partner with engineering, infrastructure, and security teams to investigate security incidents, improve operational processes, and drive cross-functional security initiatives.
• Create and maintain monitoring use cases, detection logic, playbooks, and response procedures to improve security visibility and response effectiveness.

What you'll need

• Bachelor's degree in Computer Science or a related field.
• 4 years of experience in Security Engineering or Cybersecurity.

Nice to have

• Proven ability to analyze security telemetry, access logs, and detection events to identify root causes, troubleshoot complex issues, and drive effective remediation.
• Strong communication and stakeholder management skills, with the ability to influence decisions, build alignment, and communicate security risks and recommendations through data-driven insights.
• Bachelor's degree in Computer Science, Cybersecurity, Information Security, or a related field, or equivalent practical experience.
• Hands-on experience securing large-scale web environments, including DNS, DDoS mitigation, web application attacks, bot management, vulnerability response, and security event investigations.
• 10+ years of experience in Web Security, Security Operations, Threat Detection, Incident Response, or a related cybersecurity discipline.
• Ability to travel internationally as required, with no restrictions on obtaining and maintaining necessary travel documentation.
• Industry-recognized cybersecurity certifications such as CISSP, GIAC, GSEC, GCIH, GCIA, Security+, or equivalent.
• Hands-on experience with Web Security CDN, WAF, Bot Management, or DDoS protection platforms in production environments.
• Experience analyzing large datasets using SQL and security analytics platforms such as SIEM solutions, AWS Athena, Splunk, Elastic, or similar technologies.
• Proficiency in one or more programming or scripting languages such as Python, JavaScript, Go, or Bash for automation and security engineering.
• Experience investigating and responding to web security incidents within large-scale e-commerce, technology, or internet-facing environments.
• Strong understanding of web application security principles, common attack techniques, and industry frameworks such as OWASP Top 10 and MITRE ATT&CK.
• Experience developing security automation, operational workflows, detection logic, playbooks, or response procedures.
• Excellent written and verbal communication skills with the ability to effectively collaborate across engineering, infrastructure, product, and security teams.
• Korean language proficiency is a plus but not required.

Details

• Location: Seattle, USA.
• Base pay ranges from $138,000/year to $297,000/year, based on several factors including market location, job-related knowledge, skills and experience.
• Annual bonus is 0-20% of base salary.