WAF Engineer - Information Security

1.Design, implement, and manage Imperva WAF security policies to protect internet-facing web applications and APIs.

2.Configure and continuously tune Imperva WAF rules, security policies, and exceptions to mitigate threats while minimizing false positives and business impact.

3.Provide Level 3 support for WAF-related incidents and operational issues, including troubleshooting blocked requests, application access issues, SSL/TLS errors, and connectivity problems.

4.Analyze web traffic, WAF events, and security logs to identify malicious activity, investigate incidents, and recommend appropriate mitigation measures.

5.Configure and manage protections for common web application threats, including SQL injection, cross-site scripting, malicious bots, and distributed denial-of-service (DDoS) attacks.

6.Support application onboarding to Imperva WAF, including DNS configuration, SSL/TLS certificate management, origin connectivity, and validation of security policies.

7.Use infrastructure-as-code tools, particularly Terraform, and Imperva APIs to automate supported configurations and improve operational consistency.

8.Collaborate with application, network, cloud, and security operations teams to align WAF policies with application requirements and security standards.

9.Develop and maintain operational procedures, configuration standards, troubleshooting guides, and change documentation.

10.Monitor emerging web application threats and update Imperva security policies and controls accordingly.

1. At least 7 years of hands-on experience in web application security, with a significant focus on WAF administration and security policy management.

2.Extensive experience with Imperva WAF, including configuring, managing, and tuning security policies for production applications.

3.Experience creating and managing WAF rules and exceptions, access controls, rate-limiting policies, and bot protection controls, as applicable to the deployed Imperva products.

4.Strong understanding of web application vulnerabilities and attack vectors, including the OWASP Top 10, SQL injection, cross-site scripting, and DDoS attacks.

5.Experience troubleshooting false positives, blocked requests, application availability, and WAF-related performance issues.

6.Understanding of internet-facing application performance, including latency, caching, HTTP/2, and TLS.

7.Hands-on experience with Terraform and familiarity with Imperva APIs for configuration management and automation.

8.Experience analyzing security logs and integrating WAF events with SIEM platforms such as Splunk.

9.Proficiency in at least one scripting or programming language, such as Python or Bash, for automation and analysis.

10.Experience with public cloud platforms such as AWS, Azure, or Google Cloud and their native security services.

11.Familiarity with CI/CD pipelines, change management, and version control systems such as Git.

12.Strong understanding of network protocols and web technologies, including HTTP/HTTPS, SSL/TLS, and DNS.”

Skills: Digital : Cloud Security Management~Incident Management~AI and Automation~Imperva WAF~Policy Administration-Property and Casualty