Security Research Analyst, WAF Managed Rules

Cloudflare; United States; Hybrid; USD 150,000 - 216,000; Full time

Benefits offered by this job

Equity

Job summary

Cloudflare, Inc. is seeking a Security Research Analyst to research web application threats and develop WAF protections. You will turn CVEs, threat intelligence, and telemetry into mitigations across the detection lifecycle, collaborating with engineering and product teams to close coverage gaps.

You will analyze exploit patterns, validate detections, and automate testing while communicating findings to both technical and non-technical audiences. Equity benefits are available.

Qualifications

• Hands-on experience in web application security and WAF rules.
• Ability to analyze CVEs and exploitation patterns for mitigation.
• Strong SQL skills and scripting for tooling and automation.
• Experience with large-scale security analytics and dashboards.

Responsibilities

• Research vulnerabilities and exploitation to understand root causes.
• Develop and maintain managed WAF rules and signatures.
• Investigate false positives and missed attacks to refine detections.
• Validate coverage and resistance to bypasses through testing.
• Automate research, validation, and regression testing.
• Measure detection quality using production data and dashboards.
• Collaborate with engineering, product, and detection teams.
• Share actionable research in internal reports and blogs.

Skills

WAF rules

Vulnerability research

Threat intelligence

SQL querying

Python/Go/Rust

Communication

Team collaboration

Tools

ModSecurity

OWASP CRS

Grafana

ClickHouse

Job description

About Us

At the company, we are on a mission to help build a better Internet. Today the company runs one of the world’s largest networks that powers millions of websites and other Internet properties for customers ranging from individual bloggers to SMBs to Fortune 500 companies. the company protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by the company all have web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. the company was named to Entrepreneur Magazine’s Top Company Cultures list and ranked among the World’s Most Innovative Companies by Fast Company.

At the company, we’re not looking for people who wait for a polished roadmap; we’re looking for the builders who see the cracks in the Internet that everyone else has simply learned to live with. We value candidates who have the instinct to spot a "normalized" problem and the AI-native curiosity to create a solution using the latest tools. Our culture is built on iteration, leveraging AI to ship faster today to make it better tomorrow, while ensuring that every improvement, no matter how small, is shared across the team to lift everyone up. If you’re the type of person who values curiosity over bureaucracy, and that AI is a partner in solving tough problems to keep the Internet moving forward, you’ll fit right in.

Available Locations:

Austin, TX; San Francisco, CA; New York City

About the Team

Our team researches web application attacks and turns that research into protections in the company’s Web Application Firewall (WAF). We build and maintain managed rules that help protect millions of Internet properties from known vulnerabilities, emerging exploits, and new attack techniques.

We work at the intersection of vulnerability research, large-scale traffic analysis, and detection engineering. Using threat intelligence and telemetry from the company’s global network, we identify exploitation patterns, develop mitigations, and measure how well they work against real traffic. We partner with Engineering, Product, and customer-facing teams to improve coverage while minimizing false positives and disruption to legitimate applications.

Who You Are

• You have hands-on experience in web application security, vulnerability research, or detection engineering, including writing and improving WAF rules, exploit signatures, or comparable detection logic.

• You understand HTTP/HTTPS, how web applications and proxies process requests, and common vulnerability classes such as SQL injection, cross-site scripting, remote code execution, SSRF, and insecure deserialization.

• You can analyze a vulnerability advisory or proof of concept, reproduce the exploit in a controlled environment, and identify the request characteristics that distinguish exploitation from legitimate traffic.

• You use SQL to investigate large datasets and a language such as Python, Go, or Rust to build research tools, automate analysis, and validate detections.

• You make evidence-based tradeoffs between detection coverage, false positives, and performance. You are comfortable investigating ambiguous reports and following issues through to resolution.

• You work effectively with engineers, product partners, and customer-facing teams, and communicate technical findings clearly to both technical and non-technical audiences.

• You use AI fluently in research and coding workflows and have the judgment to know where it accelerates the work and where its outputs need independent validation.

• You are curious about how attackers exploit web applications and bypass defenses. You do not need to know our exact stack, but you should be eager to go deep in the domain.

What You'll Do

We are looking for a Security Research Analyst to research web application threats and develop the managed rules that protect the company customers. You will turn public CVEs, threat intelligence, customer reports, and internal telemetry into tested, effective mitigations.

Your work will span the detection lifecycle: understanding an exploit, designing a rule, validating it against malicious and legitimate requests, and measuring its behavior in production. You will collaborate with engineering and research partners to close coverage gaps and continuously improve the quality of our WAF protections.

Key responsibilities:

• Research vulnerabilities and exploitation. Analyze public CVEs, proof-of-concept exploits, and observed attacks to understand root causes, exploit chains, and opportunities for WAF mitigation.

• Develop and maintain managed rules. Design, test, and deploy WAF managed rules and exploit signatures, keeping protections effective as applications, exploits, and attacker techniques evolve.

• Investigate false positives and missed attacks. Analyze customer reports and request telemetry, reproduce issues, and refine detections to improve protection without unnecessarily blocking legitimate traffic.

• Validate coverage and resistance to bypasses. Use targeted penetration testing, exploit variants, and adversarial testing to identify detection gaps and evaluate proposed mitigations.

• Automate research and validation. Build tools and reproducible test cases that accelerate exploit analysis, rule validation, regression testing, and traffic analysis.

• Measure detection quality. Use SQL, dashboards, and production data to assess rule efficacy, track attack trends, and guide improvements to coverage, false-positive rates, and performance.

• Collaborate across teams. Partner with Engineering, Product, and other detection teams to deliver reliable protections and resolve recurring customer problems at their roots.

• Share actionable research. Document findings, explain mitigation decisions, and contribute to internal research reports and public-facing blogs on vulnerabilities and Internet-wide attack trends.

Additional Experience We Value

• Experience developing WAF rules or contributing to open-source WAF projects, such as ModSecurity or the OWASP Core Rule Set.

• Experience finding WAF bypasses, analyzing request parsing and encoding differences, or researching novel exploitation techniques.

• Experience with large-scale security analytics, advanced SQL, columnar databases such as ClickHouse, and visualization tools such as Grafana.

• Experience building automated exploit-reproduction environments, detection test suites, or CI pipelines for security rules.

• Familiarity with Linux/UNIX systems, TCP/IP networking, reverse proxies, and the performance constraints of inspecting production traffic.

• Published security research, conference presentations, open-source security tools, or demonstrated work through bug bounty programs or CTFs.

• Experience partnering with data science or machine learning teams to combine rule-based detections with other security signals.

Compensation

Compensation may be adjusted depending on work location.

• For San Francisco based hires: Estimated annual salary of $157,000 - $216,000

• For New York City based hires: Estimated annual salary of $150,000 - $206,000

Equity

This role is eligible to participate in the company’s equity plan.