Web Application Firewall Engineer

GCP WAF / Application Security Engineer

Job Summary

We are looking for an experienced GCP WAF / Application Security Engineer with strong hands-on expertise in Web Application Firewall (WAF) engineering, WAF policy tuning, application security, threat analysis, and cloud security.

The role will work closely with SOC/CSIRT, Dev SecOps, Application Development, Cloud Engineering, and Infrastructure teams to protect applications and APIs hosted on Google Cloud Platform. The ideal candidate should have proven experience in WAF rule creation and tuning, false-positive reduction, attack analysis, security automation, and GCP security services.

Key Responsibilities

• Design, implement, manage, and tune WAF policies for web applications and APIs.
• Perform hands-on WAF rule tuning, including creating custom rules, exclusions, signatures, rate-limiting policies, and mitigating application-layer attacks.
• Analyze WAF alerts and traffic patterns to identify OWASP Top 10 attacks, bots, DDoS attempts, SQL injection, XSS, RCE, API attacks, credential attacks, and other web-based threats.
• Investigate and reduce WAF false positives while maintaining appropriate security controls.
• Work with SOC/CSIRT teams on security incidents, threat investigations, attack analysis, and incident response.
• Translate threat intelligence and security incidents into actionable WAF rules and application security controls.
• Monitor and analyze WAF logs, security events, HTTP requests, and application traffic.
• Develop and maintain custom WAF policies and security controls based on application behavior and threat intelligence.
• Partner with application teams to understand application architecture, APIs, traffic flows, and security requirements.
• Perform application security assessments and identify vulnerabilities across web applications and APIs.
• Integrate security controls into CI/CD and Dev SecOps pipelines.
• Automate WAF policy deployment, configuration management, security testing, and operational activities using Terraform, APIs, Python, or similar technologies.
• Implement security-as-code and infrastructure-as-code practices for cloud security controls.
• Support cloud security monitoring, vulnerability management, and threat detection across GCP environments.
• Participate in security incident investigations and provide technical recommendations for remediation.
• Document WAF policies, tuning decisions, security exceptions, incident findings, and operational procedures.
• Continuously improve WAF protection based on emerging threats, application changes, and security incidents.

Required Skills & Experience

WAF Engineering & Tuning Mandatory

• Strong hands-on experience in WAF engineering and WAF tuning.
• Experience creating and tuning WAF rules and policies in production environments.
• Strong understanding of false-positive identification and reduction.
• Experience analyzing HTTP/HTTPS traffic and WAF logs.
• Hands-on experience protecting web applications and APIs using WAF technologies.
• Good understanding of OWASP Top 10 and common web application attacks.
• Experience with custom rules, managed rules/signatures, exclusions, allow/deny policies, and rate limiting.
• Experience troubleshooting legitimate traffic blocked by WAF and determining appropriate tuning/exceptions.

GCP – Mandatory

• Strong practical experience with Google Cloud Platform (GCP) security.
• Hands-on experience with Google Cloud Armor / GCP WAF is highly preferred.
• Understanding of GCP networking, including VPC, Load Balancing, Cloud CDN, API Gateway, DNS, IAM, and logging/monitoring.
• Experience analyzing security events and logs using Cloud Logging and Cloud Monitoring.
• Knowledge of GCP security architecture and cloud-native application protection.

Application Security

• Strong understanding of Web Application Security and API Security.
• Knowledge of OWASP Top 10, OWASP API Security Top 10, authentication/authorization vulnerabilities, session security, injection attacks, and security headers.
• Ability to analyze application behavior and recommend appropriate WAF/security controls.
• Experience working with application development teams to remediate security findings.

SOC / CSIRT / Threat Analysis

• Experience working with SOC, CSIRT, Incident Response, or Threat Detection teams.
• Ability to investigate security alerts and determine whether activity is malicious or legitimate.
• Experience with threat analysis, attack patterns, indicators of compromise, and security event correlation.
• Ability to convert incident findings into preventive WAF rules and security controls.
• Familiarity with SIEM platforms and security monitoring processes.

Dev SecOps & Automation

• Experience integrating security controls into CI/CD pipelines.
• Hands-on experience with Terraform / Infrastructure as Code.
• Scripting/programming experience using Python, Bash, or similar languages.
• Experience automating WAF configuration, deployment, testing, monitoring, or reporting.
• Understanding of Git-based workflows and security-as-code practices.

Preferred Qualifications

• Experience with other WAF technologies such as Cloudflare, F5, Imperva, Akamai, AWS WAF, or similar platforms.
• Knowledge of API gateways, reverse proxies, load balancers, CDN technologies, and web application architectures.
• Experience with SIEM/SOAR platforms such as Splunk, Microsoft Sentinel, Q Radar, Chronicle, or similar.
• Understanding of threat intelligence feeds and frameworks such as MITRE ATT&CK.
• Experience with containerized/cloud-native environments such as Docker and Kubernetes/GKE.
• Familiarity with vulnerability management and application security testing tools.
• Experience with security testing tools such as Burp Suite, OWASP ZAP, Nessus, Qualys, or similar.
• GCP security certifications are an advantage.

Candidate Profile

The ideal candidate should be:

• A hands-on WAF Engineer, rather than purely a cloud/security architect.
• Strong in WAF rule creation, tuning, troubleshooting, and production operations.
• Comfortable investigating real-world web attacks and analyzing HTTP traffic.
• Able to work closely with SOC/CSIRT and application teams.
• Strong in GCP, particularly Cloud Armor/WAF.
• Comfortable with automation, Terraform, scripting, and Dev SecOps.
• Able to distinguish between legitimate application behavior and malicious traffic.
• Experienced in translating security incidents and threat intelligence into practical WAF protections.