Security Research Analyst: WAF Rules & Threat Mitigation

Cloudflare, Inc.; United States; Hybrid; USD 150,000 - 216,000; Full time

Benefits offered by this job

Equity

Job summary

Cloudflare, Inc. is seeking a Security Research Analyst to research web application threats and develop WAF protections. You will turn CVEs, threat intelligence, and telemetry into mitigations across the detection lifecycle, collaborating with engineering and product teams to close coverage gaps.

You will analyze exploit patterns, validate detections, and automate testing while communicating findings to both technical and non-technical audiences. Equity benefits are available.

Qualifications

• Hands-on experience in web application security and WAF rules.
• Ability to analyze CVEs and exploitation patterns for mitigation.
• Strong SQL skills and scripting for tooling and automation.
• Experience with large-scale security analytics and dashboards.

Responsibilities

• Research vulnerabilities and exploitation to understand root causes.
• Develop and maintain managed WAF rules and signatures.
• Investigate false positives and missed attacks to refine detections.
• Validate coverage and resistance to bypasses through testing.
• Automate research, validation, and regression testing.
• Measure detection quality using production data and dashboards.
• Collaborate with engineering, product, and detection teams.
• Share actionable research in internal reports and blogs.

Skills

WAF rules

Vulnerability research

Threat intelligence

SQL querying

Python/Go/Rust

Communication

Team collaboration

Tools

ModSecurity

OWASP CRS

Grafana

ClickHouse

Job description

Cloudflare, Inc. is seeking a Security Research Analyst to research web application threats and develop WAF protections. You will turn CVEs, threat intelligence, and telemetry into mitigations across the detection lifecycle, collaborating with engineering and product teams to close coverage gaps.

You will analyze exploit patterns, validate detections, and automate testing while communicating findings to both technical and non-technical audiences. Equity benefits are available.