WAF Security Engineer

Lloyds Banking Group; Manchester; On-site; GBP 80,000 - 120,000; Full time

Job summary

Jobtailor in Manchester is seeking an experienced WAF Engineer to design, implement and maintain scalable Web Application Firewall platforms protecting critical customer-facing services.

You will optimise WAF security controls, write policy-as-code, and contribute to automation, IaC, and incident response, collaborating across cloud and on‑prem environments.

Qualifications

• Hands-on experience with edge, on-premises or cloud-native WAF technologies.
• Strong understanding of networking and web fundamentals (HTTP/S, DNS, TLS).
• Experience in Application Security, API Security, Bot Protection, or Layer 7 DDoS mitigation.
• Proficiency in Python scripting and automation.
• Experience with Infrastructure-as-Code tools (Terraform).
• Familiarity with modern CI/CD pipelines.
• Ability to troubleshoot under pressure and drive solutions.

Responsibilities

• Design, implement, evolve and maintain Web Application Firewall platforms at scale.
• Design and optimise WAF security controls, rules and policies.
• Engineer WAF capabilities using IaC, CI/CD pipelines and policy-as-code approaches.
• Contribute to platform modernisation, automation and technical-debt reduction.
• Improve monitoring, alerting and telemetry to strengthen platform reliability and incident response.
• Support diagnosis and resolution of major incidents with Security Engineering, Network and Cloud teams.
• Embed secure-by-design patterns and guardrails.
• Produce engineering documentation, standards, patterns, platform guidance and runbooks.
• Participate in the on-call rota.
• Influence technical direction and raise engineering standards across WAF and Layer 7 security services.

Skills

WAF Technologies

Python Scripting

Cloud Security

CI/CD Pipelines

Automation

Education

Professional Cloud Certifications

Tools

Terraform

CI/CD Tools

Job description

• Design, implement, evolve and maintain Web Application Firewall platforms protecting critical customer-facing services at scale
• Design and continuously optimise WAF security controls, rules and policies
• Engineer WAF capabilities using Infrastructure as Code, CI/CD pipelines and policy-as-code approaches
• Contribute to platform modernisation, service improvements, refactoring, automation and technical-debt reduction
• Improve monitoring, alerting and telemetry to strengthen platform reliability and incident response
• Support diagnosis and resolution of major incidents with Security Engineering, Network and Cloud teams
• Embed secure-by-design patterns and guardrails
• Produce engineering documentation, standards, patterns, platform guidance and runbooks
• Participate in the on-call rota
• Influence technical direction and raise engineering standards across WAF and Layer 7 security services

Requirements

• Hands-on experience of edge, on-premises or cloud-native WAF technologies
• Solid understanding of networking and web fundamentals, including HTTP/S, DNS, TLS and platform security concepts
• Experience in Application Security, API Security, Bot Protection, or Layer 7 DDoS mitigation
• Strong automation and scripting skills; Python preferred
• Practical experience using Infrastructure-as-Code tools; Terraform preferred
• Experience with modern CI/CD pipelines
• Ability to contribute to complex technical investigations, diagnose issues under pressure and develop robust solutions
• Confidence to influence engineering decisions and contribute to the team’s technical direction
• Professional-level cloud certifications and/or recognised security or network engineering accreditations would be great
• Demonstrable experience with cloud-based data warehouse technologies would be great
• Interest in or experience with developing AI solutions to augment security solutions would be great
• Relevant transferable experience accepted; specific years of experience may be referenced but are not required here

Core Competencies

Demonstrates expertise in Web Application Firewall (WAF) technologies, including design, implementation, and optimization of security controls. Proficient in Infrastructure as Code, CI/CD pipelines, and automation to enhance platform reliability and incident response.

Highest-signal resume keywords

• Web Application Firewall (WAF) Technologies
• Infrastructure as Code (IaC)
• CI/CD Pipelines
• Application Security
• Python Scripting

Hard Skills

• WAF Design and Implementation
• Network Fundamentals
• HTTP/S
• DNS
• TLS
• API Security
• Bot Protection
• Layer 7 DDoS Mitigation
• Terraform
• Cloud-Based Data Warehouse Technologies

Soft Skills

• Problem-Solving
• Influencing Engineering Decisions
• Technical Direction Contribution

Certifications & Qualifications

• Professional-Level Cloud Certificates
• Security Engineering Accreditations
• Network Engineering Accreditations

Industry Keywords

• Incident Response
• Monitoring and Alerting
• Secure-by-Design Patterns
• Automation
• Technical-Debt Reduction