Senior WAF Engineer, Autonomous Defense

horizon3ai; United States; Remote; USD 140,000 - 210,000; Full time

Benefits offered by this job

Fully remote

Health insurance

Vision & dental

Flexible vacation

Parental leave

Equity / Stock options

Job summary

horizon3ai is seeking a security domain expert to define WAF detection and remediation strategies across vendor platforms. This non-coding role focuses on technical judgment and turning blue-team workflows into clear requirements for product, engineering, and AI research.

You will translate needs into prioritized requirements, set acceptance criteria, and guide policy tuning. The role is fully remote in the United States, with health/dental/vision benefits, flexible vacations, parental leave,

Qualifications

• At least five years in application security, security engineering, or incident response.
• Deep hands-on understanding of WAF configuration across major platforms.
• Ability to map blue-team workflows to practical requirements.
• Strong judgment on exploit coverage and impact on legitimate traffic.

Responsibilities

• Translate security operations needs into prioritized, buildable requirements with Product.
• Set acceptance criteria for detection and tuning features, then assess releases against those criteria.
• Advise Engineering and AI research on firewall behavior, attack techniques, and vendor-specific rule semantics.
• Maintain practical coverage knowledge of major WAF products, including their policy configuration, rule evaluation, logging, and APIs.
• Keep guidance current as platforms change their rules, APIs, managed protections, and bot or API security capabilities.
• Evaluate whether recommended changes stop validated exploit variations while preserving legitimate application traffic, working with attack validation specialists.

Skills

Application security

WAF configuration

Vendor platforms

Security operations

Job description

Role overview

Define what effective Web Application Firewall detection and remediation should look like across multiple vendor platforms. Acting as a security domain expert between Product, Engineering, and AI research, this role turns real blue team workflows and attack behavior into requirements, acceptance criteria, and standards for evaluating product output. The source describes this as a non-coding position focused on technical judgment and domain expertise.

Responsibilities

• Translate security operations needs and firewall tuning goals into prioritized, buildable requirements with Product.
• Set acceptance criteria for detection, effectiveness, and tuning features, then assess releases against those criteria.
• Advise Engineering and AI research on firewall behavior, attack techniques, and vendor-specific rule semantics.
• Maintain practical coverage knowledge of major WAF products, including their policy configuration, rule evaluation, logging, and APIs.
• Keep guidance current as platforms change their rules, APIs, managed protections, and bot or API security capabilities.
• Evaluate whether recommended changes stop validated exploit variations while preserving legitimate application traffic, working with attack validation specialists.

Requirements

• At least five years in application security, security engineering, security operations, or incident response, according to the available source excerpt.
• Deep hands-on understanding of WAF configuration and behavior across several major platforms, including rule order, managed rules, exceptions, monitoring and blocking modes, and inspection limits.
• Ability to compare vendor policy models and define equivalent intent across platforms.
• Experience translating blue team workflows into practical requirements and challenging designs that would not hold up in real security operations.
• Strong judgment in assessing exploit coverage, remediation quality, and the impact of changes on legitimate traffic.

Benefits and work setup

• The role is described as fully remote.
• The source lists health, vision, and dental coverage.
• Flexible vacation.
• Parental leave.
• Eligibility for stock options.
• Compensation varies by candidate location, qualifications, experience, and skills.