VergeCloud seeks a technically hands-on engineer who can research vulnerabilities reproduce exploits discover WAF bypasses engineer signatures and virtual patches and own product-focused SOC detection and response. This is not a scan-only VAPT or alert-monitoring position: the engineer must explain why an attack works demonstrate it in a controlled workplace encode that behavior into a robust rule prove its safety against legitimate traffic and measure the result in production telemetry.
The role also builds and operates open-source SIEM capability investigates WAF/CDN/API events improves managed-rule precision leads high-severity triage and threat hunts and automates incident enrichment and reporting. Any changes to production security policy remain human-reviewed and approved.
Advanced security automation and tooling SOAR framework integration secure prompts LLM/MCP investigations and analyst-in-the-loop AI quality evaluation.
Ideal candidate profile
A practitioner with 3 years in meaningful security engineering/research (or equivalent demonstrable expertise)
and a track record comparable to work seen in WAF/security vendors and research. The candidate must be able to explain raw HTTP requests reproduce a CVE write and test a WAF rule validate it against clean requests and origin evidence identify evasions triage real attack traffic create SIEM detections automate repetitive SOC tasks and brief product leadership.
Required Skills:
Preferred / advantageous experience ModSecurity/WAF rule-writing; security signatures authoring. Advanced security automation and tooling SOAR framework integration secure prompts LLM/MCP investigations and analyst-in-the-loop AI quality evaluation. Ideal candidate profile A practitioner with 3 years in meaningful security engineering/research (or equivalent demonstrable expertise) and a track record comparable to work seen in WAF/security vendors and research. The candidate must be able to explain raw HTTP requests reproduce a CVE write and test a WAF rule validate it against clean requests and origin evidence identify evasions triage real attack traffic create SIEM detections automate repetitive SOC tasks and brief product leadership.