WAF Security Engineer: Policy Tuning & Attack Mitigation

WTW; Philippines; On-site; PHP 600,000 - 1,000,000; Full time

Job summary

WTW is seeking an expert in web application security to analyse and tune WAF policies across multi-cloud environments. The role involves leading investigations into web attacks, developing custom WAF rules, and guiding transitions from detection to prevention modes.

You will collaborate with application owners and security stakeholders to ensure secure onboarding of internet-facing apps and provide SME guidance on WAF best practices. Extensive Azure WAF experience is highly valued.

Qualifications

• Demonstrated experience investigating, analysing and resolving WAF false positives and false negatives.
• Strong experience implementing WAF solutions in Detection mode and transitioning policies to Prevention/Block mode through tuning and validation.
• Proven experience developing and maintaining custom WAF rules, rule exclusions, rate limiting controls and attack mitigation policies.

Responsibilities

• Perform analysis and tuning of WAF policies to minimise false positives/negatives while maintaining security posture.
• Design, implement, maintain and optimise WAF policies across multi-cloud environments.
• Lead investigation and mitigation of web application attacks including OWASP Top 10, bot attacks and API abuse.
• Develop and enhance custom WAF rules, exclusions, rate-limiting policies and bot protection controls.
• Support transition of WAF policies from Detection to Prevention/Block mode through structured analysis and testing.

Education

Bachelor’s degree in Computer Science, Engineering, Information Technology

Tools

Terraform

Azure Front Door WAF

Azure Application Gateway WAF

Job description

WTW is seeking an expert in web application security to analyse and tune WAF policies across multi-cloud environments. The role involves leading investigations into web attacks, developing custom WAF rules, and guiding transitions from detection to prevention modes.

You will collaborate with application owners and security stakeholders to ensure secure onboarding of internet-facing apps and provide SME guidance on WAF best practices. Extensive Azure WAF experience is highly valued.