Application Security Engineer: WAF, API & Bot Defense

Southern Company; Birmingham (AL); Hybrid; USD 90,000 - 140,000; Full time

Job summary

Southern Company is seeking an Application Security Analyst/Engineer to protect web applications and APIs through hands-on security analysis, testing, and policy management. The role partners with developers, SOC, and operations to ensure secure access and resilient services.

The environment includes Imperva Cloud WAF, Snyk SAST/DAST, and Sonatype SCA; experience with these or similar tools is valued. This is a hybrid role with four days onsite and one remote in the Atlanta or Birmingham area.

Qualifications

• Experience in application security and testing of web apps and APIs.
• Knowledge of OWASP top 10 and risk-based security assessments.
• Ability to work with CI/CD pipelines and security automation.

Responsibilities

• Configure and tune WAF, bot protection, and API security policies.
• Analyze traffic, detect abuse and credential stuffing, and improve defenses.
• Review API auth controls and perform hands-on testing for access controls.
• Collaborate with developers and SOC to remediate findings.

Skills

OWASP

API security

WAF policy management

Bot protection

Security testing

Splunk

CI/CD security tests

Education

Security certification preferred

Tools

Imperva Cloud WAF

Snyk SAST/DAST

Sonatype SCA

Burp Suite

Postman

Splunk

Job description

Southern Company is seeking an Application Security Analyst/Engineer to protect web applications and APIs through hands-on security analysis, testing, and policy management. The role partners with developers, SOC, and operations to ensure secure access and resilient services.

The environment includes Imperva Cloud WAF, Snyk SAST/DAST, and Sonatype SCA; experience with these or similar tools is valued. This is a hybrid role with four days onsite and one remote in the Atlanta or Birmingham area.