WAF Security Researcher, Managed Rules

Cloudflare, Inc.; San Francisco (CA); On-site; USD 157,000 - 216,000; Full time

Benefits offered by this job

Medical Insurance

Dental Insurance

Vision Insurance

Flexible Spending Accounts

Commuter Spending Accounts

401(k) Retirement Savings Plan

Employee Stock Participation Plan

Flexible paid time off

Job summary

Cloudflare, Inc. is hiring a Security Research Analyst for its WAF managed rules team. The role focuses on researching web application threats and turning findings into tested mitigations that protect Cloudflare customers.

You will work across the detection lifecycle, validate rules against malicious and legitimate requests, and collaborate with Engineering, Product, and other detection teams to close coverage gaps while minimizing impact on legitimate traffic.

Qualifications

• Hands-on experience in web application security, vulnerability research, or detection engineering.
• Understand HTTP/HTTPS, web apps and proxies, and common vulnerability classes.
• Able to analyze advisories or PoCs, reproduce exploits, and identify request characteristics.
• Able to use SQL for large datasets and Python/Go/Rust to build tools.
• Make evidence-based tradeoffs between detection coverage and performance.
• Communicate findings clearly to tech and non-tech audiences.
• Fluent use of AI in research and coding workflows with validation.
• Curious about attacker techniques and willing to go deep in the domain.

Responsibilities

• Research vulnerabilities and exploitation to understand root causes and mitigations.
• Develop and maintain managed rules and exploit signatures for the WAF.
• Investigate false positives and missed attacks to refine detections.
• Validate coverage and resistance to bypasses with testing.
• Automate research, test cases, and CI pipelines for rules.
• Measure detection quality using SQL, dashboards, and production data.
• Collaborate with Engineering, Product, and other teams to improve protections.
• Share actionable research in internal reports and public blogs.

Skills

Web app security

Vulnerability research

Detection engineering

WAF rules

SQL

Python

Go

Rust

Tools

ModSecurity

OWASP CRS

Job description

Cloudflare, Inc. is hiring a Security Research Analyst for its WAF managed rules team. The role focuses on researching web application threats and turning findings into tested mitigations that protect Cloudflare customers.

You will work across the detection lifecycle, validate rules against malicious and legitimate requests, and collaborate with Engineering, Product, and other detection teams to close coverage gaps while minimizing impact on legitimate traffic.