Senior WAF Engineer, Autonomous Defense

Role overview Define what effective Web Application Firewall detection and remediation should look like across multiple vendor platforms. Acting as a security domain expert between Product, Engineering, and AI research, this role turns real blue team workflows and attack behavior into requirements, acceptance criteria, and standards for evaluating product output. The source describes this as a non-coding position focused on technical judgment and domain expertise.

Responsibilities - Translate security operations needs and firewall tuning goals into prioritized, buildable requirements with Product. - Set acceptance criteria for detection, effectiveness, and tuning features, then assess releases against those criteria. - Advise Engineering and AI research on firewall behavior, attack techniques, and vendor-specific rule semantics. - Maintain practical coverage knowledge of major WAF products, including their policy configuration, rule evaluation, logging, and APIs. - Keep guidance current as platforms change their rules, APIs, managed protections, and bot or API security capabilities. - Evaluate whether recommended changes stop validated exploit variations while preserving legitimate application traffic, working with attack validation specialists.

Requirements - At least five years in application security, security engineering, security operations, or incident response, according to the available source excerpt. - Deep hands-on understanding of WAF configuration and behavior across several major platforms, including rule order, managed rules, exceptions, monitoring and blocking modes, and inspection limits. - Ability to compare vendor policy models and define equivalent intent across platforms. - Experience translating blue team workflows into practical requirements and challenging designs that would not hold up in real security operations. - Strong judgment in assessing exploit coverage, remediation quality, and the impact of changes on legitimate traffic.

Benefits and work setup - The role is described as fully remote. - The source lists health, vision, and dental coverage, flexible vacation, parental leave, and eligibility for stock options. Compensation varies by candidate location, qualifications, experience, and skills.