WAF Security Researcher: Managed Rules & Mitigations

VulnU; Austin, New York, San Francisco (TX, NY, CA); On-site; USD 150,000 - 216,000; Full time

Benefits offered by this job

Flexible PTO

Equity

Parental leave

Job summary

Cloudflare is seeking a Security Research Analyst to advance its Web Application Firewall by researching web threats and turning findings into robust managed rules. The role requires hands-on vulnerability analysis, exploit understanding, and collaboration with engineering to deliver reliable protections.

You’ll work across CVEs, threat intel, and production telemetry, building automated tests and dashboards to measure coverage and performance.

Qualifications

• Experience in web security research and vulnerability analysis.
• Ability to design and deploy WAF rules and exploit signatures.
• Proficiency with SQL for data analysis; Python, Go, or Rust for tooling.

Responsibilities

• Research vulnerabilities and exploit techniques to improve protections.
• Design, test, and deploy WAF managed rules and signatures.
• Investigate false positives and missed attacks using telemetry and reports.
• Automate research workflows and validation with reproducible tests.
• Collaborate with engineering and product teams to harden defenses.

Skills

Web security

Vulnerability research

WAF rules

Python

SQL

Tools

ClickHouse

Grafana

Job description

Cloudflare is seeking a Security Research Analyst to advance its Web Application Firewall by researching web threats and turning findings into robust managed rules. The role requires hands-on vulnerability analysis, exploit understanding, and collaboration with engineering to deliver reliable protections.

You’ll work across CVEs, threat intel, and production telemetry, building automated tests and dashboards to measure coverage and performance.