VergeCloud seeks a technically hands-on engineer who can research vulnerabilities, reproduce exploits, discover WAF bypasses, engineer signatures and virtual patches, and own product-focused SOC detection and response. This is not a scan-only VAPT or alert-monitoring position: the engineer must explain why an attack works, demonstrate it in a controlled workplace, encode that behavior into a robust rule, prove its safety against legitimate traffic, and measure the result in production telemetry.
The role also builds and operates open-source SIEM capability, investigates WAF/CDN/API events, improves managed-rule precision, leads high-severity triage and threat hunts, and automates incident enrichment and reporting. Any changes to production security policy remain human-reviewed and approved.
Requirements
Preferred / advantageous experience
- ModSecurity/WAF rule-writing; security signatures authoring.
- Advanced security automation and tooling, SOAR framework integration, secure prompts, LLM/MCP investigations and analyst-in-the-loop AI quality evaluation.
Ideal candidate profile A practitioner with 3+ years in meaningful security engineering/research (or equivalent demonstrable expertise) and a track record comparable to work seen in WAF/security vendors and research. The candidate must be able to explain raw HTTP requests, reproduce a CVE, write and test a WAF rule, validate it against clean requests and origin evidence, identify evasions, triage real attack traffic, create SIEM detections, automate repetitive SOC tasks and brief product leadership.