Senior Security Engineer - WAF (Cloudflare)

About the role

Help AG, the cybersecurity arm of Etisalat, is looking for a Senior Security Engineer with strong hands-on experience in Web Application Firewall (WAF), application security and WAAP technologies. The role focuses mainly on Cloudflare Application Security (WAF, DDoS protection, bot management, API security and application onboarding) and provides operational and technical support for F5 Advanced WAF/ASM, Akamai WAF and Imperva WAF environments.

Key responsibilities

• Design and implement WAF and application security solutions, with a primary focus on Cloudflare WAF/WAAP, including security architecture, policies, rules, rate limiting, bot controls, API security and DDoS protection.
• Design application onboarding, DNS routing, SSL/TLS configuration and production traffic migration plans.
• Plan, stage, test and deploy WAF policies and rules, and tune them to balance security, performance and availability.
• Manage day-to-day Cloudflare WAF operations, analyse events and alerts, investigate traffic and support DDoS mitigation and attack investigations.
• Handle WAF incidents, service requests and security events within SLAs, and perform root-cause analysis for major incidents.
• Support WAF upgrades, migrations, configuration changes and maintenance, and take part in change management and maintenance windows.
• Provide L2/L3 operational support, give technical guidance to junior engineers, and take part in customer meetings.

Required profile

• 6+ years of experience in network security or cybersecurity, with strong hands-on WAF and application security experience.
• Strong hands-on experience with Cloudflare WAF/Application Security is mandatory.
• Good working experience with at least one of F5 Advanced WAF/ASM, Akamai WAF or Imperva WAF.
• Experience in a 24x7 managed security, SOC or MSSP environment is an advantage; ITIL or security certifications (CISSP, CEH, GIAC) are an advantage.

Required skills

• HTTP/HTTPS, DNS, SSL/TLS, TCP/IP, reverse proxy, CDN and load balancing concepts.
• OWASP Top 10 and common web application attacks.
• WAF policy creation, tuning, troubleshooting and false-positive analysis.
• Application onboarding and production traffic migration.
• Incident management, troubleshooting, documentation and reporting.

What we offer

• Health insurance with a leading global provider.
• Career progression through challenging projects.
• Employee engagement and wellness campaigns, and learning and development opportunities.
• Annual flight tickets.
• Inclusive, flexible/hybrid working environment and open-door policy.