Web Application Firewall Engineer

Key Responsibilities

• Engineering leadership for the WAAP capability: Act as a primary engineering lead, setting technical direction and promoting consistent engineering practices across the capability.
• Collaborate with Cyber Architecture and the WAAP Capability Owner to translate strategy, target-state architecture, control requirements, and product priorities into actionable engineering artefacts and delivery plans.
• Platform standards, templates, and guardrails: Partner with Operations to define and maintain platform standards, reference patterns, reusable engineering templates, configuration baselines, and guardrails for the seven Cyber-supported WAAP solutions.
• Ensure engineering artefacts are secure, robust, scalable, automatable, supportable, and aligned with HSBC security, risk, and compliance requirements.
• Business engagement for non-standard solutions: Engage business and technology stakeholders to assess requirements that fall outside approved patterns or standard platform capabilities.
• Provide technical options and product guidance, challenge unnecessary variation, and ensure approved deviations are risk-assessed, documented, governed, and traceable.
• Continuous improvement, discovery, and efficacy testing: Identify opportunities for new or enhanced WAAP functions, controls, automation, and operating practices.
• Lead technical discovery, proofs of concept, and efficacy testing for platform capabilities, managed and custom controls, and emerging protection requirements.
• Drive innovation, engineering quality, and delivery efficiency while keeping pace with evolving cyber threats, technology changes, and business needs.
• Feedback loops across capability, architecture, platform, and operations: Provide structured feedback to Capability and Architecture teams so lessons learned, control gaps, and improvement opportunities inform roadmaps and design decisions.
• Work with Engineering and Operations teams to understand delivery and support challenges, prioritize improvements, and provide clear product and engineering leadership through implementation and lifecycle management.

Key Accountabilities

• Own the quality, consistency, and technical integrity of engineering outputs for the WAAP capability.
• Produce and maintain engineering standards, reference designs, patterns, configuration baselines, decision records, and implementation guidance.
• Ensure requirements and architecture decisions are translated into deliverable, testable, and operationally sustainable solutions.
• Define acceptance criteria and evidence for platform controls, including functional, security, resilience, performance, and efficacy outcomes.
• Promote automation and repeatability through infrastructure-as-code, policy-as-code, APIs, and CI/CD integration where appropriate.
• Assess non-standard designs and exceptions, documenting technical rationale, risks, compensating controls, ownership, and remediation or exit plans.
• Coordinate technical discovery and evaluation of new WAAP capabilities, product features, and vendor solutions.
• Use operational telemetry, incidents, tuning outcomes, engineering feedback, and threat intelligence to identify and prioritize platform improvements.
• Facilitate design reviews and technical forums, communicating decisions and trade-offs clearly to technical and non-technical stakeholders.
• Support the WAAP roadmap by identifying dependencies, technical debt, lifecycle risks, and opportunities to simplify or consolidate the platform estate.

Ideal Candidate Profile

• Demonstrable experience engineering enterprise WAAP, WAF, API security, bot management, DDoS protection, or related application-edge security platforms.
• Experience providing technical leadership across complex, multi-platform environments and translating strategy and architecture into implementable engineering outcomes.
• Strong understanding of web and API protocols, modern application architectures, common attack techniques, and layered mitigation strategies.
• Practical experience defining platform standards, reusable patterns, configuration baselines, guardrails, and technical documentation.
• Experience with several major WAAP or WAF technologies, such as AWS, Google Cloud, Azure, Akamai, F5, Cloudflare, and an understanding of their deployment and operating models.
• Knowledge of cloud, network, application delivery, identity, observability, resilience, and DevSecOps principles relevant to WAAP services.
• Experience with automation, APIs, infrastructure-as-code, policy-as-code, source control, and CI/CD pipelines.
• Ability to design and execute proofs of concept, control validation, and efficacy testing, and to turn results into clear engineering recommendations.
• Sound risk judgement with experience assessing exceptions, documenting technical decisions, and working within security, compliance, and governance frameworks.
• Strong analytical and problem-solving skills, with the ability to balance security outcomes, business needs, operability, cost, and delivery constraints.
• Excellent written and verbal communication skills, including the ability to influence architecture, capability, engineering, operations, and business stakeholders.
• A collaborative, outcome-focused approach and a commitment to continuous learning, service improvement, and engineering excellence.