Security Researcher, WAF Managed Rules (Equity)

Cloudflare, Inc.; New York (NY); On-site; USD 150,000 - 206,000; Full time

Benefits offered by this job

Medical/Rx Insurance

Dental Insurance

Vision Insurance

Flexible Spending Accounts

Commuter Spending Accounts

Fertility & Family Forming Benefits

On‑demand mental health support and E"

Global Travel Medical Insurance

Job summary

Cloudflare, Inc. is seeking a Security Research Analyst to investigate web application threats and develop managed rules protecting Cloudflare customers.

You will convert CVEs, threat intel, customer reports, and telemetry into validated mitigations across the detection lifecycle. Your work spans understanding exploits, designing rules, validating against malicious and legitimate traffic, and measuring performance.

Qualifications

• Hands-on experience in web application security, vulnerability research, or detection engineering.
• Understanding HTTP/HTTPS, proxies, and common vulnerability classes such as SQLi, XSS, RCE, SSRF.
• Ability to analyze advisories or PoCs, reproduce exploits, and distinguish exploitation from legitimate traffic.
• SQL to investigate large datasets and Python/Go/Rust to build research tools and validations.
• Evidence-based tradeoffs between detection coverage, false positives, and performance.

Responsibilities

• Research vulnerabilities and exploitation; analyze CVEs and observed attacks to inform WAF mitigations.
• Develop and maintain managed rules and exploit signatures for evolving threats.
• Investigate false positives and missed attacks; reproduce issues and refine detections.
• Validate coverage and resistance to bypasses through targeted testing.
• Automate research and validation; build reproducible tests and regression suites.
• Measure detection quality using SQL, dashboards, and production data to drive improvements.
• Collaborate with Engineering, Product, and other teams to deliver reliable protections.
• Share actionable research; document findings and contribute to internal/public research.

Tools

ModSecurity

OWASP Core Rule Set

Job description

Cloudflare, Inc. is seeking a Security Research Analyst to investigate web application threats and develop managed rules protecting Cloudflare customers.

You will convert CVEs, threat intel, customer reports, and telemetry into validated mitigations across the detection lifecycle. Your work spans understanding exploits, designing rules, validating against malicious and legitimate traffic, and measuring performance.