Senior Security Engineer – WAF & Application Security

Help AG is looking for a Senior Security Engineer – WAF & Application Security with strong hands-on experience in Web Application Firewall (WAF), Application Security and WAAP technologies. The role will primarily focus on Cloudflare Application Security, including WAF, DDoS Protection, Bot Management, API Security and application onboarding. The engineer will also provide operational and technical support for F5 Advanced WAF/ASM, Akamai WAF and Imperva WAF environments.

The role requires strong troubleshooting, policy tuning, security rule management, incident handling, application onboarding and L3 operational support capabilities across enterprise WAF environments.

• Primary Expertise – Cloudflare Application Security

  • Cloudflare WAF and WAAP
  • WAF Managed Rules and Custom Rules
  • Security Rules / Firewall Rules
  • DDoS Protection
  • Bot Management / Bot Protection
  • API Security and API Protection
  • Rate Limiting
  • OWASP Top 10 protection
  • IP, ASN, Geo and reputation-based controls
  • SSL/TLS and security configuration
  • DNS and application onboarding
  • WAF policy tuning and false-positive management
  • Security event analysis and traffic investigation
  • Application migration and cutover activities
  • Cloudflare Zero Trust/security services exposure is an advantage

• Secondary Expertise

  • F5 Application Security
  • F5 BIG-IP Advanced WAF / ASM
  • LTM
  • WAF policies and signatures
  • Attack signatures and staging
  • Bot protection
  • DoS protection
  • iRules and traffic policies
  • WAF policy tuning and false-positive handling
  • Application onboarding and troubleshooting
  • F5 Distributed Cloud WAF/XC – added advantage
  • Akamai Application Security
  • Akamai WAF / Kona Site Defender
  • Security configurations
  • WAF rules and policies
  • Bot Manager
  • DDoS protection
  • Rate controls
  • Security event analysis
  • Application onboarding and policy tuning
  • Imperva Application Security
  • Imperva WAF / Cloud WAF
  • WAF policies and rules
  • Security profiles
  • DDoS protection
  • Bot protection
  • API security
  • False-positive analysis and policy tuning
  • Application onboarding and troubleshooting

Responsibilities:

• Lead and execute WAF and Application Security solution design and implementation activities, with primary focus on Cloudflare WAF/WAAP.
• Design WAF security architecture and traffic flows for internet-facing applications, APIs, CDN and hybrid/cloud environments.
• Develop and implement Cloudflare WAF security policies, managed/custom rules, rate limiting, bot controls, API security and DDoS protection based on application requirements.
• Design and implement application onboarding, DNS routing, SSL/TLS configuration and production traffic migration/cutover plans.
• Translate application security requirements into WAF policies and protection controls while balancing security, performance and application availability.
• Perform WAF policy planning, rule staging, testing, validation and controlled production deployment.
• Participate in technical discussions with application, network, cloud and architecture teams to define WAF implementation designs and security requirements.
• Prepare high-level and low-level implementation designs, configuration standards, implementation plans, rollback plans and technical documentation.
• Lead implementation and migration activities across Cloudflare and, where required, F5 Advanced WAF/ASM, Akamai and Imperva WAF platforms.
• Provide L2/L3 operational support for enterprise WAF and Application Security platforms.
• Manage day-to-day Cloudflare WAF operations, including application onboarding, policy configuration, rule creation and tuning.
• Analyze WAF events, security alerts and HTTP traffic to identify malicious and legitimate traffic.
• Perform WAF policy tuning and false-positive analysis while maintaining application availability.
• Configure and maintain Cloudflare WAF managed/custom rules, rate limiting, bot controls and application security policies.
• Support DDoS mitigation and application-layer attack investigations.
• Troubleshoot HTTP/HTTPS, DNS, TLS, application connectivity and traffic-flow issues.
• Perform security rule analysis based on OWASP Top 10 and common web application attacks.
• Investigate and resolve WAF-related incidents, service requests and security events within defined SLAs.
• Work closely with application, network, cloud and SOC teams during security incidents and application onboarding.
• Perform WAF health checks, configuration reviews and security posture assessments.
• Review WAF policies and recommend improvements to application security controls.
• Support WAF upgrades, migrations, configuration changes and platform maintenance.
• Perform root-cause analysis and prepare RCA reports for major incidents.
• Maintain technical documentation, configuration records, SOPs and knowledge articles.
• Participate in change management, maintenance windows and planned security improvements.
• Provide technical guidance to junior engineers and support team knowledge development.
• Participate in customer meetings and provide technical recommendations related to WAF and Application Security.

Qualifications & Skills:

• 6+ years of experience in Network Security / Cybersecurity, with strong hands-on experience in WAF and Application Security.

• ITIL / security certifications such as CISSP, CEH, GIAC, or relevant vendor certifications are an advantage.

• Strong hands-on experience with Cloudflare WAF/Application Security is mandatory.

• Good working experience with at least one or more of F5 Advanced WAF/ASM, Akamai WAF or Imperva WAF.

• Strong understanding of HTTP/HTTPS, DNS, SSL/TLS, TCP/IP, web application architecture, reverse proxy concepts and load balancing.

• Understanding of CDN concepts and application traffic flows.

• Strong knowledge of OWASP Top 10 and common web application attack techniques.

• Experience in WAF policy creation, tuning, troubleshooting and false-positive analysis.

• Experience with application onboarding and production traffic migration.

• Strong incident management and troubleshooting skills.

• Experience working in a 24x7 managed security / SOC / MSSP environment is an advantage.

• Experience with Security Controls:

  • Cloudflare WAF / WAAP

  • Cloudflare DDoS Protection

  • Cloudflare Bot Management

  • Cloudflare API Security

  • F5 Advanced WAF / ASM

  • F5 LTM

  • Akamai WAF / Kona Site Defender

  • Akamai Bot Manager

  • Imperva WAF

  • API Security

  • DDoS Protection

  • Bot Protection

  • Rate Limiting

  • OWASP protection

  • SSL/TLS Security

  • CDN / Reverse Proxy

  • DNS Security

  • Application Security Monitoring

• Strong analytical and troubleshooting skills.

• Excellent understanding of web application traffic and security threats.

• Ability to analyze WAF logs and identify attack patterns.

• Strong customer-facing and communication skills.

• Ability to handle critical production incidents and security escalations.

• Good understanding of change, incident and problem management processes.

• Ability to work independently and take ownership of technical issues.

• Strong documentation and reporting skills.

• Willingness to mentor junior engineers and contribute to team knowledge development.

Benefits:

• Health insurance with one of the leading global providers for medical insurance.
• Career progression and growth through challenging projects and work.
• Employee engagement and wellness campaigns activities throughout the year.
• Excellent learning and development opportunities.
• Annual flights tickets.
• Inclusive and diverse working environment.
• Flexible/Hybrid working environment.
• Open door policy.

About Us:

Help AG, the cybersecurity arm of Etisalat, is the Middle East's trusted cybersecurity partner, enabling governments, enterprises and critical industries to innovate with confidence. Combining strategic consulting, advanced managed security services and deep technology expertise, Help AG helps organisations strengthen cyber resilience, secure AI adoption and build trusted sovereign digital environments. With regional expertise and a customer-first approach, Help AG delivers end-to-end cybersecurity capabilities designed to protect critical operations, manage evolving risks and support secure digital transformation. Through continuous innovation, trusted partnerships and measurable outcomes, Help AG enables organisations to remain resilient, prepared and confident in a complex digital world.