Job Summary

We are looking for an experienced WAF & Application Security Subject Matter Expert (SME) to strengthen web application and API security across multiple applications and platforms. The role focuses on WAF engineering, advanced rule development, efficacy testing, policy tuning, false-positive mitigation, and security posture enhancement.

The ideal candidate will have hands-on experience with at least three major WAF vendors, a strong background in SOC/CSIRT, Application Security (AppSec), or Ethical Hacking, and expertise in web attack analysis, security automation, and DevSecOps. The candidate will play a key role in identifying security gaps, mitigating attack evasions, developing custom protection rules, and integrating automated security testing into CI/CD pipelines.

Key Responsibilities

- Design, develop, and implement custom WAF rules and security features to address vulnerabilities, security gaps, and baseline compliance requirements.
- Evaluate WAF rulesets, features, and configurations to maximize the detection and mitigation of web-based and API-based attacks.
- Develop and execute efficacy testing for baseline policies, custom rules, WAF Proofs of Concept (PoCs), new features, and security solutions.
- Integrate automated WAF testing and security validation into CI/CD pipelines to support DevSecOps initiatives.
- Monitor and review WAF tuning requests, conduct detailed log analysis, identify false positives, and recommend appropriate policy adjustments.
- Analyze web traffic, attack payloads, and security events to identify evasion techniques and develop effective mitigation strategies.
- Perform reverse engineering of attack payloads and exploits, where required, to strengthen WAF protection.
- Configure, optimize, and troubleshoot WAF policies, signatures, access controls, rate limiting, bot mitigation, and virtual patching.
- Provide SME guidance on web and API attack methodologies, application security, WAF architecture, and mitigation techniques.
- Support WAF migrations, upgrades, policy rollouts, production deployments, and security solution assessments.




- Collaborate with SOC/CSIRT, AppSec, DevSecOps, infrastructure, network, and application development teams to integrate security solutions.
- Conduct regular WAF configuration reviews and security assessments to ensure compliance with security baselines and industry best practices.
- Maintain comprehensive documentation covering WAF configurations, tuning procedures, policies, test cases, and operational standards.
- Stay updated on emerging vulnerabilities, attack techniques, security threats, and WAF technologies to continuously improve security effectiveness.

Must-Have Skills

- Extensive hands-on experience in WAF implementation, engineering, configuration, administration, tuning, and troubleshooting.
- Practical experience with at least three major WAF vendors, such as F5 Advanced WAF/ASM, Akamai, AWS WAF, Cloudflare, Imperva, or Azure WAF.
- Strong knowledge of web application security, API security, HTTP/HTTPS, TLS/SSL, HTTP headers, cookies, sessions, reverse proxies, and load balancers.
- Expertise in identifying and mitigating SQL Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Remote Code Execution (RCE), API attacks, and WAF evasion techniques.
- Proven experience in custom WAF rule development, security policy optimization, signature management, and false-positive analysis.
- Strong background in SOC/CSIRT, Application Security, Ethical Hacking, penetration testing, or security incident investigation.
- Hands-on experience with log analysis and monitoring tools such as Splunk, Microsoft Sentinel, Wireshark, or custom scripts.
- Experience designing and executing WAF efficacy tests and validating security controls against attack scenarios.




- Practical knowledge of DevSecOps, CI/CD pipelines, test automation, and security testing integration.
- Solid analytical, troubleshooting, documentation, and problem-solving skills.

Preferred Skills

- Experience with cloud application security across AWS, Microsoft Azure, and Google Cloud Platform (GCP).
- Knowledge of OWASP Top 10, OWASP API Security Top 10, secure coding principles, and vulnerability remediation.
- Experience with REST APIs, JSON traffic inspection, API protection, bot mitigation, and rate limiting.
- Familiarity with VAPT, penetration testing, vulnerability management, virtual patching, and remediation validation.
- Experience in WAF architecture design, migrations, upgrades, enterprise-wide policy rollouts, and production deployments.
- Knowledge of incident response, threat hunting, root-cause analysis, and SIEM integration.
- Experience developing automation scripts using Python, Bash, or similar scripting languages.
- Familiarity with security compliance standards such as PCI DSS and ISO 27001.
- Ability to provide technical guidance to application teams and collaborate with security, network, infrastructure, and development stakeholders.
- Strong communication skills and the ability to explain complex security concepts to technical and non-technical teams.

Education

- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related technical discipline.
- Relevant certifications in application security, ethical hacking, cloud security, or WAF technologies are preferred

Pay: ₹731,000.00 - ₹3,000,000.00 per year

Application Question(s):

- Mention your last working date

Experience:

- Web application Firewall: 5 years (Preferred)
- Waf tools: 5 years (Preferred)
- Akamai: 4 years (Preferred)
- Appsec: 5 years (Preferred)
- Web attacks: 6 years (Preferred)
- Devsecops: 5 years (Preferred)
- Cloudflare: 5 years (Preferred)

Location:

- Hyderabad, Telangana (Preferred)

Work Location: Hybrid remote in Pune, Maharashtra 410001

📌 WAF & Application Security SME (Web Application Firewall Specialist) (Pune)
🏢 RAAH TECHSERVICES
📍 Pune