Web Application Firewall Engineer

Purview Services; United States; Remote; USD 100,000 - 130,000; Full time

Job summary

Purview Services is seeking a WAF Engineer with over 10 years of experience in web application security. The role involves delivering web application and API protection on the Akamai platform, tuning WAF settings, and collaborating with teams to enhance security measures.

The ideal candidate will have extensive experience in WAF management and log analysis, ensuring optimal security posture through proactive measures. This position offers flexibility with remote work arrangements.

Qualifications

• Extensive experience in WAF management, tuning, and engineering.
• Proven track record of identifying and mitigating false positives.
• Proficiency in log analysis tools and techniques.

Responsibilities

• Deliver web application and API protection primarily on the Akamai platform.
• Conduct detailed log analysis to optimize WAF rules.
• Collaborate with teams for seamless integration of WAF solutions.

Skills

WAF management

Web application security principles

Log analysis

Cross-functional collaboration

Job description

Role: WAF Engineer

Exp: 10+ years

Location: Hyderabad

Mode: Remote

Job Description

Key Responsibilities

• Consult with Capability Lead to deliver Web Application and API Protection for our critical applications, primarily on the Akamai platform.
• Monitor and review all tuning requests.
• Conduct detailed log analysis to identify false positives and optimize WAF rules for improved accuracy and performance.
• Create and maintain comprehensive documentation for WAF tuning, tuning procedures, policies, and configurations.
• Develop, test, and recommend WAF policies and rules tailored to specific applications and environments.
• Proactively assist with identifying false positives.
• Collaborate with cross-functional teams to ensure seamless integration of WAF solutions into existing security infrastructure.
• Collaborate with Application teams to enable web application protection.
• Deliver anti-bypass protection for on‑premise application currently using Akamai.
• Provide recommendations for WAF configuration based on best practices and security requirements.
• Perform regular assessments and audits of WAF configurations to ensure optimal security posture and compliance with industry standards.
• Maintain evidence for audit and regulatory asks.
• Deliver monthly / quarterly business reviews for application owners to show the effectiveness of the WAF control.
• Stay updated with the latest web security threats, vulnerabilities, and trends to continually enhance WAF effectiveness.
• Evaluate, design, and deliver new and alternative WAAP features and/or solutions.

Key Accountabilities

• Ensuring alignment with capability lead and control owner to deliver consistent WAAP policies across multiple infrastructures.
• Ensuring timely and accurate review and action on all WAF tuning requests.
• Conducting thorough log analyses to effectively identify and mitigate false positives, ensuring optimized WAF rules.
• Maintaining comprehensive and up‑to‑date documentation for all WAF tuning procedures, policies, and configurations.
• Developing and recommending tailored WAF policies and rules for various applications and environments.
• Proactively identifying and addressing false positives to enhance overall WAF accuracy.
• Collaborating effectively with cross‑functional teams to integrate WAF solutions seamlessly into existing security infrastructure.
• Collaborating effectively with application teams to enable WAF protection across HSBC.
• Ensuring connectivity to origin servers on premise only comes through Akamai to prevent direct to origin attacks.
• Providing expert recommendations for WAF configurations based on best practices and current security requirements.
• Performing regular assessments and audits of WAF configurations to maintain optimal security posture and compliance with industry standards and maintaining evidence.
• Performing service reviews with accountable service / application owners.
• Staying informed about the latest web security threats, vulnerabilities, and trends to ensure continuous enhancement of WAF effectiveness.
• Reviewing existing and new solutions to deliver best in class protections.

Ideal Candidate Profile

• Extensive experience in WAF management, tuning, and engineering, with a strong understanding of web application security principles.
• Proven track record of proactively identifying and mitigating false positives to optimize WAF performance.
• Background in SOC or CSIRT environments, demonstrating hands‑on experience in in-depth log analysis.
• Proficiency in log analysis tools and techniques, with the ability to identify patterns and anomalies in web traffic.