Cyber Security Engineer (WAF)

Position Title: Cyber Security Engineer (WAF)

Department: Cyber Security

Position Overview

We are seeking a WAF Security Engineer with a minimum of 3 years of dedicated, hands-on experience designing, implementing, tuning, and operating Web Application Firewall (WAF) solutions, preferably Akamai (App & API Protector). You will protect our web applications and APIs by creating custom policies, tuning rules to reduce false positives, responding to threats, and maintaining continuous compliance.

Key Responsibilities

1. WAF Deployment & Application Onboarding

• Design, deploy, and maintain WAF protection for the organization's web applications.
• Onboard applications to the WAF and has knowledge on DNS/CNAME configuration, and TLS/certificate management.
• Test all new onboarding and policy changes in the Akamai staging network first, validating application functionality, authentication flows, and API behavior before any production activation.
• Promote validated configurations from staging to production through a controlled, phased rollout.
• Initially deploy new applications in alert/monitor mode, and analyze traffic and WAF events to identify false positives before enabling protection.
• Continuously monitor onboarded applications after the switch to block mode, and quickly tune rules or add exceptions if legitimate traffic is affected.
• Manage Akamai configurations (security configurations, match targets, property rules) through the Akamai Control Center and APIs, with proper version control.

2. WAF Policy Creation & Fine-Tuning

• Create, test, and maintain custom WAF rules and policies (rate controls, URL/path protections, IP/Geo controls, custom rules, and virtual patching) aligned to each application's risk profile.
• Tune managed rule sets (Akamai Adaptive Security Engine) to minimize false positives and false negatives, using attack group tuning, exceptions, and rule exclusions.
• Run new rules in alert/monitor mode, review the results, and promote to deny mode with documented validation.

3. Threat Protection & OWASP Alignment

• Apply deep knowledge of the OWASP Top 10, OWASP API Security Top 10, and OWASP Automated Threats to design controls against SQL injection, XSS, CSRF, SSRF, RCE, file inclusion, broken authentication, and business logic abuse.
• Respond rapidly to zero-day vulnerabilities and emerging threats with emergency virtual patches.
• Map findings from vulnerability scans, pen tests, and SaaS vendor advisories to WAF mitigations.

4. Monitoring, Incident Response & Forensics

• Monitor WAF events in real time, triage alerts, investigate attack patterns, and recommend or implement blocking actions.
• Perform root-cause analysis for blocked legitimate traffic, availability issues, and security incidents.
• Maintain emergency response procedures for active attacks, including rapid rule deployment and traffic-shaping measures.
• Analyze historical traffic and attack logs (up to 1 year of retention) for compliance investigations and trend analysis.

5. Dashboards, Reporting & Compliance

• Build technical and executive dashboards tracking attack trends, blocked vs. allowed traffic, top attack vectors, false-positive rates, and application protection coverage.
• Generate compliance reports covering protected applications, policy status, and rule changes for audits (PCI DSS, ISO 27001, SOC 2).
• Provide regular security posture reviews and tuning recommendations to application owners and leadership.

Required Technical Skills & Qualifications

WAF Expertise

• 3+ years of hands-on experience with enterprise WAF platforms, Akamai preferred (App & API Protector). Equivalent experience with Cloudflare, Imperva, F5 Advanced WAF, AWS WAF, or Azure WAF is acceptable.
• Proven experience creating custom WAF policies and performing rule tuning in production environments.
• Strong knowledge of the OWASP Top 10, OWASP API Top 10, and OWASP Core Rule Set.

Web & Network Fundamentals

• Deep understanding of HTTP/HTTPS, TLS, DNS, cookies/sessions, REST/GraphQL APIs, and reverse proxy/CDN architectures.
• Familiarity with SaaS delivery models, SSO/SAML/OAuth flows, and network security concepts.

Nice to Have

• Experience with bot mitigation, API discovery, and client-side protection.
• Experience with pen-test validation tools such as Burp Suite, OWASP ZAP, or Postman.
• Familiarity with MITRE ATT&CK and threat intelligence feeds.