Hiring GCP Cloud WAF Engineer

2coms; Bengaluru; On-site; INR 1,800,000 - 2,800,000; Full time

Job summary

2coms is seeking a GCP Cloud WAF Engineer to deploy and manage WAF solutions across all internet-facing and internal apps. You will ensure regulatory compliance, develop custom WAF rules, and support DevSecOps automation in a run-the-bank Agile environment.

Join a team collaborating with HSBC Cloud Platform Leads and Change Teams to deliver secure, scalable WAF processes and incident response coordination.

Qualifications

• 6-10 years of proven cloud security experience with WAF solutions across edge, cloud, and on-prem environments.
• Hands-on expertise with GCP native security services including WAF and DDoS protection.
• Akamai or Cloudflare WAF and DDoS mitigation solutions, plus F5 WAF experience.
• Strong understanding of OWASP Top 10 and mitigation strategies; WAF tuning and policy lifecycle management.

Responsibilities

• Design, implement, and maintain WAF policies and configurations across GCP and hybrid environments.
• Develop and deploy custom WAF rules to address application threats and security gaps.
• Conduct false positive analysis and fine-tune WAF rules for security and availability.
• Lead baseline policy updates and ensure alignment with regulatory standards.
• Collaborate with Global Business Teams, Change Teams, and Project Managers to manage WAF requests.

Skills

GCP security

WAF & DDoS

Vendor WAFs (Akamai/Cloudflare)

F5 WAF

SOC liaison

DevSecOps

Tools

Akamai WAF

Cloudflare WAF

F5 WAF

Git

HTTPS inspection

Job description

Summary

The GCP Cloud WAF Engineer plays a critical role within the ECB Programme, responsible for deploying and managing WAF solutions across all internet-facing and internal web applications to ensure compliance with the Bank’s regulatory requirements. Operating as part of the Run the Bank team using Agile methodologies, this role involves close collaboration with Global Business Teams to develop custom WAF rules, manage exceptions, conduct false positive analysis, and maintain baseline security policies. The engineer will serve as a key technical liaison with vendor teams, HSBC Cloud Platform Leads, and Change Teams, ensuring timely resolution of service requests and seamless implementation. With a strong focus on DevSecOps, the role supports automation pipelines, identifies opportunities for process optimization, and ensures robust security posture across cloud environments. This position demands proactive risk identification, stakeholder engagement, and clear communication with senior leaders across Business, Cloud, Compliance, and Cyber functions.

Location: Pune / Mumbai / Bangalore / Chennai / Hyderabad / Noida

Responsibilities

• Design, implement, and maintain WAF policies and configurations across GCP and hybrid environments.
• Develop and deploy custom WAF rules to address application-specific threats and security gaps.
• Conduct false positive analysis and fine-tune WAF rules to balance security and application availability.
• Support baseline policy updates and ensure alignment with MVP and regulatory standards.
• Collaborate with Global Business Teams, Change Teams, and Project Managers to manage WAF-related requests and service issues.
• Provide technical leadership in resolving WAF incidents, including coordination with SOC during security events.
• Maintain and enhance DevSecOps automation pipelines for WAF configuration and deployment.
• Identify and implement new automation use cases to improve operational efficiency and security.
• Manage version control, updates, and change tracking for WAF configurations across environments.
• Ensure proper HTTPS inspection, certificate management, and termination strategies are in place.
• Support rate limiting and traffic control mechanisms within WAF frameworks.
• Maintain comprehensive documentation for WAF processes, configurations, and incident handling.
• Interface with vendors and HSBC Cloud Platform Leads for escalations, updates, and technical alignment.
• Monitor and optimize logging and monitoring capabilities for WAF in cloud environments.

Requirements

Proven experience (6-10 years) in cloud security, with a focus on WAF solutions across edge, cloud, and on-premises environments.

• Strong hands-on expertise with GCP native security services, including WAF and DDoS protection.
• In - depth knowledge of Akamai or Cloudflare WAF and DDoS mitigation solutions.
• Demonstrated experience with F5 WAF and DDoS protection technologies.
• Solid understanding of web application security threats (e.g., OWASP Top 10) and effective mitigation strategies.
• Proficiency in WAF tuning, configuration, and policy lifecycle management.
• Experience in designing and implementing secure, scalable WAF processes and documentation.
• Familiarity with IDAM protocols and access control mechanisms for WAF administration.
• Strong grasp of HTTPS inspection, certificate lifecycle management, and secure communication practices.
• Experience with rate limiting and traffic throttling techniques in WAF configurations.
• Working knowledge of version control systems (e.g., Git) and change management practices.
• Experience in interfacing with Security Operations Centers (SOC) during incident response.
• Basic networking and connectivity troubleshooting skills in cloud environments.
• Ability to manage multiple priorities, communicate effectively with stakeholders, and escal risks proactively.

Mandatory Skills

• Cloud Security GCP Native Security
• WAF DDoS Akamai
• WAF DDoS F5

Primary Skills

• WAF (Akamai or Cloudflare)
• GCP

Secondary Skills

• Networking
• Cloud Security