Web Application Firewall Security Engineer
First seen by Alion on Sep 16, 2026.
Role Overview :
The Web Application Firewall (WAF) Security Engineer is a critical role within our Network Security Team, focusing on protecting internet-facing applications through the implementation and management of WAF solutions. This role is ideal for individuals with strong WAF experience and a proven track record in security policy development and infrastructure as code (IaC) automation.
Key Responsibilities :
- Design, implement, and manage WAF security policies, with a primary focus on Cloudflare, to protect internet-facing applications.
- Continuously refine and improve WAF rules and policies, standardizing operational practices and creating detailed documentation.
- Provide L3 level support for operational issues, troubleshoot and resolve complex problems.
- Employ infrastructure-as-code (IaC) tooling, particularly Terraform, to automate the provisioning and management of configurations.
- Conduct in-depth analyses of web traffic patterns and security logs to identify and mitigate potential threats.
- Collaborate with application teams to ensure WAF policies align with security requirements and best practices.
- Stay current with emerging web application threats and adjust WAF policies accordingly.
Qualifications :
- At least 5 years of hands-on experience in Web Application Security, with a significant focus on security policy management.
- Extensive experience with Cloudflare WAF, including writing and tuning security policies.
- Experience with Custom WAF rules such as Firewall Rules, Rate Limiting, Bot Management, Managed Rules.
- Deeper understanding of performance considerations for an internet facing site such as latency, caching strategies, HTTP/2, and TLS 1.3.
- Strong knowledge of web application security concepts, common vulnerabilities (e.g., OWASP Top 10), and attack vectors (DDoS).
- Hands-on experience with infrastructure-as-code, particularly Terraform.
- Experience with log / data analysis and SIEM tools (e.g., Splunk).
- Proficiency in at least one scripting or programming language (e.g., Python, Bash) for automation tasks.
- Experience with public cloud providers (AWS, Azure, or GCP) and their native security services.
- Familiarity with CI/CD pipelines and version control systems (e.g., Git).
- Understanding of network protocols and web technologies (HTTP/HTTPS, SSL/TLS, DNS).
Soft Skills :
- Excellent communication skills, with the ability to explain complex security concepts to both technical and non-technical stakeholders.
- Strong analytical and problem-solving skills, with attention to detail in policy writing and configuration.
- Ability to work independently and as part of a team in a fast-paced environment.
- Proactive approach to identifying and mitigating security risks.
- Adaptability and continuous learning to keep up with evolving threats and technologies.
- Experience in managing stakeholder expectations and collaborating with cross-functional teams.
- Ability to prioritize tasks effectively and manage multiple projects simultaneously.
Skills
Cloudflare, WAF, Terraform, Security, Splunk, Python, Bash Scripting, AWS, Applications Security, SIEM