WAF Engineer

Overview

WAF Senior Engineer to secure web applications and APIs using Web Application Firewalls and edge security controls, owning WAF policy and operational response.

What you'll do

• Design, implement, and manage WAF policies for web applications and APIs across dev, stage, and prod.
• Configure and tune managed and custom WAF rules to mitigate OWASP Top 10 threats.
• Reduce false positives using traffic baselining, exception handling, and staged enforcement (monitor to block).
• Implement rate limiting, IP reputation, geo/ASN controls, and bot mitigation to reduce abuse.
• Integrate WAF logs with SIEM/log platforms and create dashboards/alerts for threat monitoring.
• Support incident response for active attacks and perform rapid mitigation and post-incident improvements.
• Automate WAF deployments using IaC and integrate with CI/CD pipelines.

What you'll need

• 7+ years experience in WAF engineering, application security, or edge security.
• Hands-on experience with at least one WAF platform (e.g., AWS WAF, Azure WAF, Cloudflare, F5 ASM/Advanced WAF, Imperva, Akamai, or ModSecurity).
• Strong understanding of HTTP/HTTPS, web app architecture, and REST APIs.
• Proven experience tuning WAF rules to balance security vs false positives.
• Experience with logging/monitoring and SIEM integrations.
• Scripting/automation skills with PowerShell/Python/Bash (including regex and JSON/YAML).
• Familiarity with CI/CD and Infrastructure-as-Code principles.

Details

• Position calls for a WAF Sr Engineer with 5 to 7+ years of experience.
• Imperva experience is preferable with 3+ years.