Summary

The GCP Cloud WAF Engineer plays a critical role within the ECB Programme, responsible for deploying and managing WAF solutions across all internet-facing and internal web applications to ensure compliance with the Bank’s regulatory requirements. Operating as part of the Run the Bank team using Agile methodologies, this role involves close collaboration with Global Business Teams to develop custom WAF rules, manage exceptions, conduct false positive analysis, and maintain baseline security policies. The engineer will serve as a key technical liaison with vendor teams, HSBC Cloud Platform Leads, and Change Teams, ensuring timely resolution of service requests and seamless implementation. With a strong focus on DevSecOps, the role supports automation pipelines, identifies opportunities for process optimization, and ensures robust security posture across cloud environments. This position demands proactive risk identification, stakeholder engagement, and clear communication with senior leaders across Business, Cloud, Compliance, and Cyber functions.

Location: Pune / Mumbai / Bangalore / Chennai / Hyderabad / Noida
Responsibilities

- Design, implement, and maintain WAF policies and configurations across GCP and hybrid environments.

- Develop and deploy custom WAF rules to address application-specific threats and security gaps.

- Conduct false positive analysis and fine-tune WAF rules to balance security and application availability.

- Support baseline policy updates and ensure alignment with MVP and regulatory standards.

- Collaborate with Global Business Teams, Change Teams, and Project Managers to manage WAF-related requests and service issues.

- Provide technical leadership in resolving WAF incidents, including coordination with SOC during security events.

- Maintain and enhance DevSecOps automation pipelines for WAF configuration and deployment.

- Identify and implement current automation use cases to improve operational efficiency and security.

- Manage version control, updates,



and change tracking for WAF configurations across environments.

- Ensure proper HTTPS inspection, certificate management, and termination strategies are in place.

- Support rate limiting and traffic control mechanisms within WAF frameworks.

- Maintain comprehensive documentation for WAF processes, configurations, and incident handling.

- Interface with vendors and HSBC Cloud Platform Leads for escalations, updates, and technical alignment.

- Monitor and optimize logging and monitoring capabilities for WAF in cloud environments.

RequirementsProven experience (6-10 years) in cloud security, with a focus on WAF solutions across edge, cloud, and on-premises environments.

- Strong hands-on expertise with GCP native security services, including WAF and DDoS protection.

- In-depth knowledge of Akamai or Cloudflare WAF and DDoS mitigation solutions.

- Demonstrated experience with F5 WAF and DDoS protection technologies.

- Solid understanding of web application security threats (e.g., OWASP Top 10) and effective mitigation strategies.

- Proficiency in WAF tuning, configuration, and policy lifecycle management.

- Experience in designing and implementing secure, scalable WAF processes and documentation.

- Familiarity with IDAM protocols and access control mechanisms for WAF administration.

- Strong grasp of HTTPS inspection, certificate lifecycle management, and secure communication practices.

- Experience with rate limiting and traffic throttling techniques in WAF configurations.

- Working knowledge of version control systems (e.g., Git) and change management practices.

- Experience in interfacing with Security Operations Centers (SOC) during incident response.

- Basic networking and connectivity troubleshooting skills in cloud environments.

- Ability to manage multiple priorities, communicate effectively with stakeholders, and escalate risks proactively.

Mandatory Skills

- Cloud Security – GCP Native Security

- WAF DDoS – Akamai

- WAF DDoS – F5

Primary Skills

- WAF (Akamai or Cloudflare)

- GCP

Secondary Skills

- Networking

- Cloud Security

📌 Hiring || GCP Cloud WAF Engineer (Bengaluru)
🏢 2COMs
📍 Bengaluru