WAF and Bot Management Specialist

AirAsia; Sepang; On-site; MYR 100,000 - 150,000; Full time

Job summary

A leading airline company in Malaysia is seeking a WAF and Bot Management Specialist to enhance web application security. The successful candidate will design and manage WAF solutions, ensuring ongoing protection against cyber threats. This role requires strong analytical skills and a minimum of 2 years in web application security, with a bachelor's degree in related fields. Join us in a diverse environment committed to equal opportunity.

Benefits

Equal opportunity employment

Diverse work environment

Qualifications

• Minimum of 2+ years of experience in WAF management or web application security.
• Proven expertise in designing and managing WAF solutions.
• Strong analytical and problem-solving skills.

Responsibilities

• Design, deploy, configure, and maintain WAF policies and rulesets.
• Lead the strategy and implementation of anti-bot solutions.
• Utilize SIEM platforms for log analysis and detection.

Skills

Technical expertise in WAF technologies

Analytical skills for threat detection

Communication skills

Understanding of web application vulnerabilities

Experience with scripting languages

Education

Bachelor's degree in Computer Science

Tools

Cloudflare WAF

SIEM platforms (e.g., Splunk)

Job description

Job Description

The WAF and Bot Management Specialist will be a key member of our cybersecurity operations team, responsible for the design, implementation, management, and optimization of our Web Application Firewall (WAF) solutions. This role requires deep technical expertise in WAF technologies, strong analytical skills for threat detection and response, and a proactive approach to enhancing our security posture. The successful candidate will play a critical role in safeguarding our web applications against a wide range of cyberattacks.

Key Responsibilities:

• WAF Management & Optimization:

  • Design, deploy, configure, and maintain WAF policies and rulesets to protect web applications from common vulnerabilities and emerging threats.

  • Perform regular reviews and fine-tuning of WAF configurations to minimize false positives while ensuring comprehensive protection.

  • Collaborate with application development to integrate WAF security controls into the application lifecycle.

• Threat Detection & Incident Response:

  • Lead the strategy, implementation, and fine-tuning of anti-bot solutions to combat sophisticated automated threats, including scraping, ATO, DDoS etc.

  • Monitor WAF logs and alerts for suspicious activities, security incidents, and potential breaches.

  • Conduct in-depth analysis of WAF logs, network traffic, and application behavior to identify attack patterns, compromise indicators, and sophisticated threats.

  • Lead incident response activities related to web application attacks, including investigation, containment, eradication, recovery, and post-mortem analysis.

  • Develop and implement custom detection rules and signatures based on threat intelligence and observed attack techniques.

• Log Analysis & Pattern Detection:

  • Utilize SIEM platforms and other security tools to perform advanced log analysis, correlation, and anomaly detection.

  • Develop and refine analytical techniques to identify subtle attack patterns and indicators of compromise that may evade standard defenses.

  • Generate actionable intelligence from security logs to improve WAF efficacy and overall security posture.

• Vulnerability Management & Remediation:

  • Work closely with security testing teams (e.g., penetration testers, vulnerability scanners) to understand identified vulnerabilities and implement appropriate WAF countermeasures.

• Reporting & Documentation:

  • Prepare and present regular reports on WAF performance, security incidents, and threat landscape trends.

  • Maintain comprehensive documentation of WAF configurations, policies, procedures, and incident response playbooks.

• Mentorship & Collaboration:

  • Provide technical guidance and mentorship to junior analysts within the team.

  • Collaborate effectively with cross-functional teams, including IT operations, development, and compliance.

Qualifications:

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field.

• Minimum of 2+ years of experience in a dedicated WAF management or web application security role.

• Proven expertise in designing, implementing, and managing WAF solutions.

• Strong understanding of web application vulnerabilities (OWASP Top 10, CWE), attack vectors, and mitigation strategies.

• Excellent analytical, problem-solving, and critical thinking skills.

• Strong communication skills, both written and verbal, with the ability to articulate complex technical concepts to diverse audiences.

• Ability to work independently and as part of a collaborative team in a fast-paced environment.

Nice to Have:

• Hands-on experience with Cloudflare WAF, DDoS protection, and related security services.

• Relevant industry certifications (e.g., CISSP, GWAPT, GWEB, CEH).

• Experience with cloud security platforms (AWS, Azure, GCP) and containerized environments.

• Experience in e-commerce environments

• Demonstrable experience with log analysis, SIEM platforms (e.g., Splunk, Elastic Stack, Microsoft Sentinel), and advanced pattern detection techniques.

• Proficiency in scripting languages (e.g.,SQL, Python, PowerShell) for automation and data analysis is a plus.

We are all different - one talent to another - that is how we rely on our differences. At AirAsia, you will be treated fairly and given all chances to be your best.We are committed to creating a diverse work environment and are proud to be an equal opportunity employer.

Search Firm Representatives - AirAsia does not accept unsolicited assistance from search firms for employment opportunities. All CVs / resumes submitted by search firms to any employee at our company without a valid written search agreement in place will be deemed the sole property of our company. No fee will be paid in the event a candidate is hired by our company as a result of an agency referral where no pre-existing agreement is in place.