- Consult with Capability Lead to deliver Web Application and API Protection for our critical applications, primarily on the Akamai platform.
- Monitor and review all tuning requests.
- Conduct detailed log analysis to identify false positives and optimize WAF rules for improved accuracy and performance.
- Create and maintain comprehensive documentation for WAF tuning, tuning procedures, policies, and configurations.
- Develop, test, and recommend WAF policies and rules tailored to specific applications and environments.
- Proactively assist with identifying false positives
- Collaborate with cross-functional teams to ensure seamless integration of WAF solutions into existing security infrastructure.
- Collaborate with Application teams to enable web application protection.
- Deliver anti-bypass protection for on-premise application currently using Akamai.
- Provide recommendations for WAF configuration based on best practices and security requirements.
- Perform regular assessments and audits of WAF configurations to ensure optimal security posture and compliance with industry standards.
- Maintain evidence for audit and regulatory asks
- Deliver monthly / quarterly business reviews for application owners to show the effectiveness of the WAF control.
- Stay updated with the latest web security threats, vulnerabilities, and trends to continually enhance WAF effectiveness.
- Evaluate, design, and deliver new and alternative WAAP features and/or solutions.
Key Accountabilities
- Ensuring alignment with capability lead and control owner to deliver consistent WAAP policies across multiple infrastructures.
- Ensuring timely and accurate review and action on all WAF tuning requests.
- Conducting thorough log analyses to effectively identify and mitigate false positives, ensuring optimized WAF rules.
- Maintaining comprehensive and up-to-date documentation for all WAF tuning procedures, policies, and configurations.
- Developing and recommending tailored WAF policies and rules for various applications and environments.
- Proactively identifying and addressing false positives to enhance overall WAF accuracy.
- Collaborating effectively with cross-functional teams to integrate WAF solutions seamlessly into existing security infrastructure.
- Collaborating effectively with application teams to enable WAF protection across HSBC.
- Ensuring connectivity to origin servers on premise only comes through Akamai to prevent direct to origin attacks.
- Providing expert recommendations for WAF configurations based on best practices and current security requirements.
- Performing regular assessments and audits of WAF configurations to maintain optimal security posture and compliance with industry standards and maintaining evidence.
- Performing service reviews with accountable service / application owners.
- Staying informed about the latest web security threats, vulnerabilities, and trends to ensure continuous enhancement of WAF effectiveness.
- Review existing and recent solutions to deliver best in class protections.
Ideal Candidate Profile
- Extensive experience in WAF management, tuning, and engineering, with a strong understanding of web application security principles.
- Proven track record of proactively identifying and mitigating false positives to optimize WAF performance.
- Background in SOC or CSIRT environments, demonstrating hands-on experience in in-depth log analysis.
- Proficiency in log analysis tools and techniques, with the ability to identify patterns and anomalies in web traffic