Architect

The Cloud RTB WAF Engineer will be working on the ECB Programme which aims to deploy WAF solutions on all HSBC domain/names related to HBCE covering internet-facing and the internal web applications in order to meet the Bank's regulatory requirement. The role is to work as part of the Run The Bank team where, using the Agile framework, you will work closely with Global Business Teams for Custom Rules and Exception handling, advise teams on False Positive analysis and Baseline policy updates. This role also requires maintaining communications / relationships with the Vendor teams when required as well as, the HSBC Cloud Platform Leads. You will also be responsible for servicing existing and new requests for WAF, dealing with service issues and managing a number of requests at one time that will mean working closely with the Change Teams and other stakeholders to resolve any issues so that implementation can be as seamless as possible.

CORE SKILLS/TECHNICAL REQUIREMENT

Strong experience with multiple WAF solutions for edge, cloud, and on-premise

• Strong experience with cloud services and their WAF controls, ideally including one or more of the following: AWS, Azure, and GCP
• Strong understanding of Web Application security attack methods and mitigations
• Proficiency in WAF tuning and configuration, coupled with a strong foundation in web security principles and practices.
• Develop custom WAF rules and features, addressing gaps and enhancing overall security measures
• Capability to design and implement bespoke WAF processes and documentation, underpinned by a thorough understanding of web application security.
• Analytical skills to review and align platforms with MVP and Baseline Configurations, leveraging a deep knowledge of WAF functionalities and limitations.
• Providing DevSecOps pipeline maintenance support for the automation works
• Familiarity with IDAM protocols and access control measures for WAF management, informed by strong web security knowledge.
• Understanding of HTTPS inspection, including Termination and Certificate management, grounded in robust web security practices.
• Experience in rate limiting techniques and their integration into security configurations