Summary:
The Cloud WAF Engineer (GCP) plays a critical role within the ECB Programme, driving the deployment and management of Web Application Firewall (WAF) solutions across all client-facing and internal web applications to ensure compliance with regulatory standards. Operating as part of the Run the Bank team using Agile methodologies, this role involves close collaboration with Global Business Teams, Cyber, Compliance, and Cloud Platform Leads to develop custom WAF rules, manage exceptions, conduct false positive analysis, and maintain baseline policies. The engineer will serve as a key technical advisor on WAF strategy, support DevSecOps automation pipelines, and ensure seamless service delivery through effective coordination with Change Teams and stakeholders. With a focus on proactive risk identification, status reporting, and incident response, the role is essential in strengthening the organization’s security posture across cloud environments, particularly within GCP.

Location:PAN INDIA
Responsibilities:

- Design, configure, and tune WAF policies for cloud (GCP), edge, and on-premises environments.

- Develop and implement custom WAF rules to address security gaps and evolving threat landscapes.

- Lead false positive analysis and baseline policy optimization in alignment with security best practices.

- Collaborate with Global Business Teams and Cyber/Compliance stakeholders to manage exceptions and ensure regulatory adherence.

- Support DevSecOps initiatives by maintaining and enhancing automation pipelines for WAF configuration and deployment.

- Identify and implement new automation opportunities to improve efficiency and consistency in WAF operations.

- Interface with vendor teams (e.g., F5, Akamai) for technical support, updates, and issue resolution.

- Manage multiple WAF service requests concurrently, coordinating with Change Teams and stakeholders for timely resolution.





- Provide technical guidance during WAF-related security incidents in coordination with SOC/CSIRT teams.

- Maintain and document WAF processes, configurations, and version control mechanisms.

- Ensure secure HTTPS inspection practices, including certificate management and termination strategies.

- Implement and manage rate limiting and other protective measures within WAF configurations.

- Monitor and optimize logging and monitoring capabilities for security visibility in cloud environments.

- Engage with HSBC Cloud Platform Leads and senior stakeholders to drive strategic WAF initiatives.

Requirements

- 5–10 years of experience in cloud security, with a robust focus on WAF implementation and management.

- Proven expertise in multiple WAF platforms, including F5, Akamai, and GCP-native WAF solutions.

- In-depth knowledge of cloud security principles, particularly within Google Cloud Platform (GCP).

- Hands-on experience with web application security threats (e.g., OWASP Top 10) and mitigation techniques.

- Demonstrated ability to design, develop, and maintain custom WAF rules and security policies.

- Experience in DevSecOps environments, including automation pipeline support and CI/CD integration.

- Strong understanding of IDAM protocols and access control mechanisms for secure WAF management.

- Practical experience in HTTPS inspection, certificate lifecycle management, and secure TLS configurations.

- Proficiency in rate limiting strategies and their integration into security frameworks.

- Experience with version control systems and change management processes for WAF configurations.

- Ability to analyze and document logging and monitoring options across cloud platforms with a security-first mindset.

- Track record of working with SOC/CSIRT teams during security incidents and threat response.

- Solid networking and service management skills for troubleshooting connectivity and performance issues.

Mandatory Skills:

- Cloud Security – AWS Native Security

- WAF DDoS – Akamai

- WAF DDoS – F5

📌 Hiring || Cloud WAF Engineer GCP (Bengaluru)
🏢 2COMs
📍 Bengaluru