Application Security Engineer

InterSources Inc.; New York (NY); On-site; USD 120,000 - 180,000; Full time

Job summary

InterSources Inc. in New York is seeking a security-focused engineer to lead hands-on cloud and web application protection. You will implement and tune WAF policies, monitor threats, and harden deployments across cloud environments.

The role requires strong OWASP Top 10 knowledge, SAST/DAST/SCA tool experience, and the ability to integrate telemetry into dashboards for security metrics.

Qualifications

• 5+ years Hands-on experience with Cloudflare WAF policies, rulesets, firewall rules, bot management, DNS, DDoS, logpush (Cloudflare WAF).
• 4+ Hands-on experience with Akamai WAF (KSD/Property Manager, Bot Manager, Edge DNS, log staging/testing).
• Deep understanding of OWASP Top 10, secure development practices and app security principles.
• 5+ Experience with SAST/DAST/SCA tools such as Checkmarx, BurpSuite, Fortify, or equivalents.
• Experience analyzing HTTP traffic, headers, payloads, and attack vectors (XSS, SQLi, RCE, deserialization, CSRF, SSRF).
• Experience with cloud platforms (Azure, AWS, SaaS) and modern application architectures.
• Experience integrating or consuming security telemetry from WAFs, scanners, SIEM/SOAR, and cloud logs to build dashboards and metrics.

Skills

Cloudflare WAF

Akamai WAF

OWASP Top 10

SAST/DAST/SCA tools

HTTP traffic analysis

Cloud platforms

Security telemetry integration

Job description

• 5+ years Hands‐on experience with Cloudflare WAF (policies, rulesets, firewall rules, bot management, DNS, DDoS, logpush).
• 4+ Hands‐on experience with Akamai WAF (KSD/Property Manager, Bot Manager, Edge DNS, log staging/testing).
• Deep understanding of OWASP Top 10, application security principles, secure development practices.
• 5+ Experience with SAST/DAST/SCA tools such as Checkmarx, BurpSuite, Fortify, or equivalents.
• Experience analyzing HTTP traffic, headers, payloads, and attack vectors (XSS, SQLi, RCE, deserialization, CSRF, SSRF, etc.).
• Experience with cloud platforms (Azure, AWS, SaaS) and modern application architectures.
• Experience integrating or consuming security telemetry from WAFs, scanners, SIEM/SOAR, and cloud logs to build dashboards and metrics.