Senior - Web Application Firewall

EY; Bengaluru; On-site; INR 1,800,000 - 2,800,000; Full time

Job summary

EY in Bengaluru is seeking a Senior Web Application Firewall (WAF) Engineer to own the end-to-end lifecycle of our application security gateway infrastructure. You will guide the Assess, Build, Transition and Operations phases, tuning WAF rules, integrating with CI/CD pipelines, and collaborating with development and DevOps teams to protect APIs and microservices against OWASP Top 10, botnets, and DDoS.

This is a full-time, on-site role based in Bengaluru, requiring deep security expertise and

Qualifications

• 35 years of specialized experience in web app security or ADC management.
• Deep hands-on expertise with leading WAF platforms (Cloudflare, Akamai, Imperva, F5, AWS/Azure WAF).
• Strong understanding of OWASP Top 10, API Top 10, and common web vulnerabilities.
• Solid knowledge of HTTP/S, REST/JSON, TLS handshakes, and reverse proxy architectures.
• Experience with automation via Python or Bash and IaC (Terraform/CloudFormation).
• Industry certifications in security are preferred.

Responsibilities

• Assess web apps and API endpoints for WAF coverage, threat modeling, and architecture reviews.
• Deploy and manage enterprise WAF solutions; design negative and positive security models.
• Tune bot mitigation, rate limiting, and API security inspections; integrate with CI/CD.
• Transition policies from monitoring to blocking with safe cutovers and UAT.
• Operate and monitor WAF, analyze traffic, and maintain logs for compliance and incident response.

Skills

WAF administration

Web application security

Threat modeling

CI/CD integration

Python or Bash scripting

Security architecture

Tools

Cloudflare Enterprise

Akamai Kona

Imperva

F5 BIG-IP ASM

AWS WAF

Terraform / CloudFormation

Job description

Job Summary

Job Description: Senior Web Application Firewall (WAF) Engineer

Experience Level: 35 Years

Role Type: Full-Time

Role Overview

We are seeking a Senior Web Application Firewall (WAF) Engineer to own and drive the end-to-end lifecycle of our application security gateway infrastructure. Spanning the complete service delivery model Assess, Build, Transition, and Operations, this role requires deep technical proficiency in protecting modern web applications, APIs, and microservices against sophisticated Layer 7 attacks (including OWASP Top 10, botnets, and DDoS). The ideal candidate will have hands-on experience tuning advanced WAF rule sets, managing positive and negative security models, and collaborating closely with application development and DevOps teams.

Key Responsibilities Assess (Architecture Review & Threat Modeling)

• Conduct thorough security assessments of existing web applications, API endpoints, and ingress traffic architectures.
• Analyze current WAF policies, anomaly scores, and signature rulesets to identify coverage gaps against the OWASP Top 10 and API Security Top 10.
• Collaborate with development and architecture teams to threat-model upcoming applications and define WAF integration requirements.
• Audit SSL/TLS termination configurations, cipher suites, and certificate lifecycles at the edge.

Build (Deployment & Policy Engineering)

• Deploy, configure, and manage enterprise WAF solutions (e.g., Cloudflare Enterprise, Akamai Kona, Imperva, F5 Advanced WAF/BIG-IP ASM, or AWS WAF).
• Design and implement both negative security models (signatures, regex blocks) and positive security models (strict schema validation, OpenAPI/Swagger enforcement).
• Configure advanced bot mitigation, rate limiting, geo-fencing, and API security inspection layers.
• Integrate WAF infrastructure with CI/CD pipelines (Infrastructure as Code) for automated policy deployment and version control.

Transition (Testing, Cutover & Handover)

• Transition WAF policies from monitoring/audit mode to blocking mode safely, minimizing false positives and disruption to legitimate user traffic.
• Coordinate User Acceptance Testing (UAT) and application functional sign-offs prior to production traffic routing.
• Produce comprehensive "As-Built" documentation, tuning guidelines, escalation playbooks, and topology diagrams.
• Conduct training and knowledge transfer sessions for operations and application support teams.

Operations & Continuous Management

• Serve as the senior technical escalation point for complex Layer 7 security incidents, DDoS attacks, and web traffic anomalies.
• Perform continuous rule tuning, signature optimization, and exception handling based on application updates and vulnerability scan results.
• Monitor WAF performance, backend latency, error rates, and evasion technique indicators.
• Ensure seamless log ingestion and telemetry forwarding to the SIEM/SOAR platforms for deep forensic investigation and continuous compliance reporting.
• Understand ITIL-based Change Management, managing end-to-end change lifecycle activities, CAB coordination, and compliant implementation of infrastructure and application changes.

Required Skills & Qualifications

• Experience: 35 years of specialized experience in web application security, WAF administration, or application delivery controller (ADC) management.
• Core Technologies: Deep, hands-on expertise with leading cloud or on-premise WAF platforms (e.g., Cloudflare, Akamai, Imperva, F5 Advanced WAF, or AWS/Azure WAF).
• Security Principles: Comprehensive understanding of the OWASP Top 10, API Top 10, SQL injection, Cross-Site Scripting (XSS), Remote Code Execution (RCE), and XML/JSON attacks.
• Networking & Protocols: Solid grasp of HTTP/HTTPS protocols, RESTful APIs, JSON/XML payloads, DNS, SSL/TLS handshakes, and reverse proxy architectures.
• Automation & Scripting: Familiarity with automation tools, Python or Bash scripting, and Infrastructure as Code (Terraform/CloudFormation) for policy management.
• Certifications: Industry certifications (e.g., Certified AppSec Practitioner (CAP), CISSP, CCSP, or vendor-specific WAF/Cloud security credentials) are highly preferred.
• Soft Skills: Excellent stakeholder management skills, ability to bridge security requirements with developer workflows, and strong analytical problem-solving abilities.