Security Research Analyst, WAF Managed Rules

Description

The company runs one of the largest networks in the world, serving customers from individual bloggers to small businesses to Fortune 500 firms.

The company protects and speeds up any web application without new hardware, installed software, or code changes. Traffic is routed through a global network that improves with every request, so customers see better performance and fewer spam and attacks.

The team researches web application attacks and turns that work into protections in the company's Web Application Firewall (WAF). It builds and maintains managed rules that guard millions of Internet properties against known vulnerabilities, emerging exploits, and new attack techniques.

The work sits where vulnerability research, large-scale traffic analysis, and detection engineering meet. The team uses threat intelligence and telemetry from the global network to find exploitation patterns, build mitigations, and measure them against real traffic. It works with Engineering, Product, and customer-facing teams to widen coverage while keeping false positives and disruption to legitimate applications low.

The company wants builders who notice problems that others have stopped questioning, and who are curious enough to build fixes with the latest AI tools. Teams iterate quickly, use AI to ship sooner, and share every improvement so the whole group benefits. Curiosity matters more than bureaucracy here.

Responsibilities

• Research web application threats and build the managed rules that protect customers.
• Turn public CVEs, threat intelligence, customer reports, and internal telemetry into tested, effective mitigations.
• Own the detection lifecycle: understand an exploit, design a rule, test it against malicious and legitimate requests, and measure how it behaves in production.
• Work with engineering and research partners to close coverage gaps and keep WAF protections improving.
• Study public CVEs, proof-of-concept exploits, and observed attacks to find root causes, exploit chains, and ways to mitigate them in the WAF.
• Design, test, and deploy managed rules and exploit signatures, and keep them effective as applications, exploits, and attacker methods change.
• Look into false positives and missed attacks. Review customer reports and request data, reproduce the problems, and refine detections so legitimate traffic is not blocked unnecessarily.
• Check coverage and resistance to bypasses through targeted penetration testing, exploit variants, and adversarial testing, then judge proposed mitigations.
• Build tools and reproducible test cases that speed up exploit analysis, rule validation, regression testing, and traffic analysis.
• Use SQL, dashboards, and production data to assess rule efficacy, follow attack trends, and recommend changes to coverage, false-positive rates, and performance.
• Work with Engineering, Product, and other detection teams to ship reliable protections and fix recurring customer problems at their source.
• Document findings and explain mitigation decisions. Contribute to internal research reports and public blog posts on vulnerabilities and Internet-wide attack trends.

Requirements

• You have hands-on experience in web application security, vulnerability research, or detection engineering, including writing or improving WAF rules, exploit signatures, or similar detection logic.
• You understand HTTP and HTTPS, how web applications and proxies handle requests, and common vulnerability classes such as SQL injection, cross-site scripting, remote code execution, SSRF, and insecure deserialization.
• You can read a vulnerability advisory or proof of concept, reproduce the exploit in a controlled setting, and pinpoint the request traits that separate exploitation from normal traffic.
• You use SQL on large datasets and use a language such as Python, Go, or Rust to build research tools, automate analysis, and validate detections.
• You weigh detection coverage, false positives, and performance using evidence. You are comfortable with ambiguous reports and see issues through to resolution.
• You work well with engineers, product partners, and customer-facing teams, and explain technical findings clearly to technical and non-technical audiences.
• You use AI fluently in research and coding, and you know when it speeds up the work and when its output needs independent checking.
• You are curious about how attackers exploit web applications and get past defenses, and you want to go deep in the domain. Knowing the company's exact stack is not required.
• Additional experience we value: building or contributing to WAF rules or open-source WAF projects such as ModSecurity or the OWASP Core Rule Set.
• Additional experience we value: finding WAF bypasses, analyzing request parsing and encoding differences, or researching new exploitation techniques.
• Additional experience we value: large-scale security analytics, advanced SQL, columnar databases such as ClickHouse, and visualization tools such as Grafana.
• Additional experience we value: building automated exploit-reproduction environments, detection test suites, or CI pipelines for security rules.
• Additional experience we value: familiarity with Linux or UNIX, TCP/IP networking, reverse proxies, and the performance limits of inspecting production traffic.
• Additional experience we value: published security research, conference talks, open-source security tools, or work shown through bug bounty programs or CTFs.
• Additional experience we value: working with data science or machine learning teams to combine rule-based detections with other security signals.

Conditions

Based in Austin, TX; San Francisco, CA; or New York City.

San Francisco based hires: estimated annual salary of $157,000 to $216,000.

New York City based hires: estimated annual salary of $150,000 to $206,000.

Equity: this role is eligible to join the company's equity plan.

Candidates who reach the offer stage may be asked to attend an in-person interview at a company office or hub.

The role may involve access to information controlled under U.S. export laws, including the Export Administration Regulations, and any offer may depend on your authorization to receive that technology without sponsorship for an export license.

Benefits

• Medical, dental, and vision insurance, plus prescription coverage for U.S. employees.
• Flexible spending accounts and commuter spending accounts.
• Fertility and family-forming benefits.
• On-demand mental health support and an Employee Assistance Program.
• Global travel medical insurance.
• Short- and long-term disability insurance, and life and accident insurance.
• 401(k) retirement savings plan and an employee stock participation plan.
• Flexible paid time off covering vacation and sick leave.
• Leave programs, including parental, pregnancy health, medical, and bereavement leave.
• Benefits for employees outside the U.S. may differ.