Senior Security Engineer - WAF (Cloudflare)

Help AG; Dubai; Hybrid; AED 300,000 - 480,000; Full time

Benefits offered by this job

Health insurance

Annual flights tickets

Flexible/Hybrid working environment

Open door policy

Career progression opportunities

Job summary

Help AG in Dubai seeks a Senior Security Engineer specializing in Cloudflare WAF/WAAP, DDoS protection, bot management and API security. The role covers onboarding, policy tuning, and security event analysis across cloud and hybrid environments.

You will design secure web architectures, manage incidents, and drive production migrations while collaborating with SOC, network, cloud and application teams. F5/Akamai/Imperva WAF experience is valued and a mentorship focus is present.

Qualifications

• 6+ years in Network Security/Cybersecurity with hands-on WAF/App Security experience.
• Strong Cloudflare WAF/Application Security expertise mandatory.
• Experience with F5/Akamai/Imperva WAF platforms is advantageous.
• Solid understanding of HTTP/HTTPS, DNS, SSL/TLS, TCP/IP, web app architecture and reverse proxy concepts.

Responsibilities

• Lead WAF and App Security solution design and implementation, focusing on Cloudflare WAF/WAAP.
• Design WAF security architectures and traffic flows for internet-facing apps, APIs, CDN and hybrid/cloud environments.
• Develop and implement Cloudflare WAF policies, managed/custom rules, rate limiting and DDoS protection.
• Design application onboarding, DNS routing, SSL/TLS config and production traffic migration/cutover plans.
• Translate security requirements into WAF policies balancing security, performance and availability.
• Perform WAF policy planning, rule staging, testing, validation and controlled production deployment.
• Lead cross-functional discussions to define designs and security requirements.
• Prepare implementation designs, standards, rollout plans and technical docs.

Skills

Cloudflare WAF

WAF / WAAP

F5 Advanced WAF / ASM

Akamai WAF

Imperva WAF

OWASP Top 10

DDoS Protection

Bot Management

API Security

SSL/TLS

DNS Security

WAF policy tuning

Incident management

Troubleshooting

Production traffic migration

LTM

iRules

SOC operations

Tools

Cloudflare WAF tooling

F5 BIG-IP ASM

Akamai Kona Site Defender

Imperva WAF tooling

Job description

Help AG is looking for a Senior Security Engineer – WAF & Application Security with strong hands-on experience in Web Application Firewall (WAF), Application Security and WAAP technologies. The role will primarily focus on Cloudflare Application Security, including WAF, DDoS Protection, Bot Management, API Security and application onboarding. The engineer will also provide operational and technical support for F5 Advanced WAF/ASM, Akamai WAF and Imperva WAF environments.

The role requires strong troubleshooting, policy tuning, security rule management, incident handling, application onboarding and L3 operational support capabilities across enterprise WAF environments.

• Primary Expertise – Cloudflare Application Security
• Cloudflare WAF and WAAP
• WAF Managed Rules and Custom Rules
• Security Rules / Firewall Rules
• DDoS Protection
• Bot Management / Bot Protection
• API Security and API Protection
• Rate Limiting
• OWASP Top 10 protection
• IP, ASN, Geo and reputation-based controls
• SSL/TLS and security configuration
• DNS and application onboarding
• WAF policy tuning and false-positive management
• Security event analysis and traffic investigation
• Application migration and cutover activities
• Cloudflare Zero Trust/security services exposure is an advantage
• Secondary Expertise
• F5 Application Security
• F5 BIG-IP Advanced WAF / ASM
• LTM
• WAF policies and signatures
• Attack signatures and staging
• Bot protection
• DoS protection
• iRules and traffic policies
• WAF policy tuning and false-positive handling
• Application onboarding and troubleshooting
• F5 Distributed Cloud WAF/XC – added advantage
• Akamai Application Security
• Akamai WAF / Kona Site Defender
• Security configurations
• WAF rules and policies
• Bot Manager
• DDoS protection
• Rate controls
• Security event analysis
• Application onboarding and policy tuning
• Imperva Application Security
• Imperva WAF / Cloud WAF
• WAF policies and rules
• Security profiles
• DDoS protection
• Bot protection
• API security
• False-positive analysis and policy tuning
• Application onboarding and troubleshooting

Responsibilities

• Lead and execute WAF and Application Security solution design and implementation activities, with primary focus on Cloudflare WAF/WAAP.
• Design WAF security architecture and traffic flows for internet-facing applications, APIs, CDN and hybrid/cloud environments.
• Develop and implement Cloudflare WAF security policies, managed/custom rules, rate limiting, bot controls, API security and DDoS protection based on application requirements.
• Design and implement application onboarding, DNS routing, SSL/TLS configuration and production traffic migration/cutover plans.
• Translate application security requirements into WAF policies and protection controls while balancing security, performance and application availability.
• Perform WAF policy planning, rule staging, testing, validation and controlled production deployment.
• Participate in technical discussions with application, network, cloud and architecture teams to define WAF implementation designs and security requirements.
• Prepare high-level and low-level implementation designs, configuration standards, implementation plans, rollback plans and technical documentation.
• Lead implementation and migration activities across Cloudflare and, where required, F5 Advanced WAF/ASM, Akamai and Imperva WAF platforms.
• Provide L2/L3 operational support for enterprise WAF and Application Security platforms.
• Manage day-to-day Cloudflare WAF operations, including application onboarding, policy configuration, rule creation and tuning.
• Analyze WAF events, security alerts and HTTP traffic to identify malicious and legitimate traffic.
• Perform WAF policy tuning and false-positive analysis while maintaining application availability.
• Configure and maintain Cloudflare WAF managed/custom rules, rate limiting, bot controls and application security policies.
• Support DDoS mitigation and application-layer attack investigations.
• Troubleshoot HTTP/HTTPS, DNS, TLS, application connectivity and traffic-flow issues.
• Perform security rule analysis based on OWASP Top 10 and common web application attacks.
• Investigate and resolve WAF-related incidents, service requests and security events within defined SLAs.
• Work closely with application, network, cloud and SOC teams during security incidents and application onboarding.
• Perform WAF health checks, configuration reviews and security posture assessments.
• Review WAF policies and recommend improvements to application security controls.
• Support WAF upgrades, migrations, configuration changes and platform maintenance.
• Perform root‑cause analysis and prepare RCA reports for major incidents.
• Maintain technical documentation, configuration records, SOPs and knowledge articles.
• Participate in change management, maintenance windows and planned security improvements.
• Provide technical guidance to junior engineers and support team knowledge development.
• Participate in customer meetings and provide technical recommendations related to WAF and Application Security.

Qualifications & Skills

• 6+ years of experience in Network Security / Cybersecurity, with strong hands-on experience in WAF and Application Security.
• ITIL / security certifications such as CISSP, CEH, GIAC, or relevant vendor certifications are an advantage.
• Strong hands‑on experience with Cloudflare WAF/Application Security is mandatory.
• Good working experience with at least one or more of F5 Advanced WAF/ASM, Akamai WAF or Imperva WAF.
• Strong understanding of HTTP/HTTPS, DNS, SSL/TLS, TCP/IP, web application architecture, reverse proxy concepts and load balancing.
• Understanding of CDN concepts and application traffic flows.
• Strong knowledge of OWASP Top 10 and common web application attack techniques.
• Experience in WAF policy creation, tuning, troubleshooting and false‑positive analysis.
• Experience with application onboarding and production traffic migration.
• Strong incident management and troubleshooting skills.
• Experience working in a 24x7 managed security / SOC / MSSP environment is an advantage.
• Experience with Security Controls:
• Cloudflare WAF / WAAP
• Cloudflare DDoS Protection
• Cloudflare Bot Management
• Cloudflare API Security
• F5 Advanced WAF / ASM
• F5 LTM
• Akamai WAF / Kona Site Defender
• Akamai Bot Manager
• Imperva WAF
• API Security
• DDoS Protection
• Bot Protection
• Rate Limiting
• OWASP protection
• SSL/TLS Security
• CDN / Reverse Proxy
• DNS Security
• Application Security Monitoring
• Strong analytical and troubleshooting skills.
• Excellent understanding of web application traffic and security threats.
• Ability to analyze WAF logs and identify attack patterns.
• Strong customer-facing and communication skills.
• Ability to handle critical production incidents and security escalations.
• Good understanding of change, incident and problem management processes.
• Ability to work independently and take ownership of technical issues.
• Strong documentation and reporting skills.
• Willingness to mentor junior engineers and contribute to team knowledge development.

Benefits

• Health insurance with one of the leading global providers for medical insurance.
• Career progression and growth through challenging projects and work.
• Employee engagement and wellness campaigns activities throughout the year.
• Excellent learning and development opportunities.
• Annual flights tickets.
• Inclusive and diverse working environment.
• Flexible/Hybrid working environment.
• Open door policy.

About Us

Help AG, the cybersecurity arm of Etisalat, is the Middle East's trusted cybersecurity partner, enabling governments, enterprises and critical industries to innovate with confidence. Combining strategic consulting, advanced managed security services and deep technology expertise, Help AG helps organisations strengthen cyber resilience, secure AI adoption and build trusted sovereign digital environments. With regional expertise and a customer-first approach, Help AG delivers end-to-end cybersecurity capabilities designed to protect critical operations, manage evolving risks and support secure digital transformation. Through continuous innovation, trusted partnerships and measurable outcomes, Help AG enables organisations to remain resilient, prepared and confident in a complex digital world.