Security Research Analyst, WAF Managed Rules

LinuxCareers; Austin (TX); On-site; USD 150,000 - 216,000; Full time

Job summary

Cloudflare is seeking a Security Research Analyst to research web application threats and develop managed rules for the Web Application Firewall (WAF). This role focuses on turning vulnerability research, threat intelligence, and large-scale traffic analysis into effective protections that defend millions of Internet properties from known vulnerabilities and emerging exploits.

You will collaborate across Engineering, Product, and customer-facing teams to continuously improve detections, analyze

Qualifications

• Hands-on experience in web application security, vulnerability research, or detection engineering, including writing WAF rules or comparable detection logic.
• Understanding of HTTP/HTTPS, web application and proxy request processing, and common vulnerability classes including SQL injection, XSS, RCE, SSRF, and insecure deserialization.
• Ability to analyze vulnerability advisories, reproduce exploits in controlled environments, and identify request characteristics that distinguish exploitation from legitimate traffic.
• Proficiency with SQL to investigate large datasets and a programming language such as Python, Go, or Rust for building research tools and validation.
• Strong communication skills to explain technical findings to both technical and non-technical audiences and work effectively across multiple teams.

Responsibilities

• Research vulnerabilities and exploitation techniques by analyzing CVEs, proof-of-concept exploits, and observed attacks to identify WAF mitigation opportunities
• Design, test, and deploy WAF managed rules and exploit signatures that evolve with application changes and attacker techniques
• Investigate false positives and missed attacks using customer reports and request telemetry to refine detections
• Validate detection coverage and resistance to bypasses using penetration testing, exploit variants, and adversarial testing
• Build tools and automated test suites to accelerate exploit analysis, rule validation, and regression testing
• Measure detection quality using SQL, dashboards, and production data to assess rule efficacy and guide improvements
• Collaborate with Engineering, Product, and customer-facing teams to deliver reliable protections and resolve recurring issues

Skills

Web security

SQL

Python/Go/Rust

HTTP/HTTPS

Communication

Job description

Cloudflare is seeking a Security Research Analyst to research web application threats and develop managed rules for the Web Application Firewall (WAF). This role focuses on turning vulnerability research, threat intelligence, and large-scale traffic analysis into effective protections that defend millions of Internet properties from known vulnerabilities and emerging exploits.

What You'll Do

• Research vulnerabilities and exploitation techniques by analyzing CVEs, proof-of-concept exploits, and observed attacks to identify WAF mitigation opportunities
• Design, test, and deploy WAF managed rules and exploit signatures that evolve with application changes and attacker techniques
• Investigate false positives and missed attacks using customer reports and request telemetry to refine detections
• Validate detection coverage and resistance to bypasses using penetration testing, exploit variants, and adversarial testing
• Build tools and automated test suites to accelerate exploit analysis, rule validation, and regression testing
• Measure detection quality using SQL, dashboards, and production data to assess rule efficacy and guide improvements
• Collaborate with Engineering, Product, and customer-facing teams to deliver reliable protections and resolve recurring issues

What You Need

• Hands‑on experience in web application security, vulnerability research, or detection engineering, including writing WAF rules or comparable detection logic
• Understanding of HTTP/HTTPS, web application and proxy request processing, and common vulnerability classes including SQL injection, XSS, RCE, SSRF, and insecure deserialization
• Ability to analyze vulnerability advisories, reproduce exploits in controlled environments, and identify request characteristics that distinguish exploitation from legitimate traffic
• Proficiency with SQL to investigate large datasets and a programming language such as Python, Go, or Rust for building research tools and validation
• Strong communication skills to explain technical findings to both technical and non‑technical audiences and work effectively across multiple teams

Nice to Have

• Experience developing WAF rules or contributing to open‑source WAF projects such as ModSecurity or OWASP Core Rule Set
• Experience finding WAF bypasses, analyzing request parsing and encoding differences, or researching novel exploitation techniques
• Experience with large‑scale security analytics, advanced SQL, columnar databases such as ClickHouse, and visualization tools such as Grafana
• Familiarity with Linux/UNIX systems, TCP/IP networking, reverse proxies, and production traffic inspection performance constraints
• Published security research, conference presentations, open‑source security tools, or demonstrated work through bug bounty programs or CTFs

Estimated annual salary of $157,000–$216,000 for San Francisco based hires; $150,000–$206,000 for New York City based hires. Equity participation eligible. Comprehensive benefits including medical/dental/vision insurance, 401(k), flexible paid time off, parental leave, and mental health support.