Security Research Analyst, WAF Managed Rules

Required

• You have hands-on experience in web application security, vulnerability research, or detection engineering, including writing and improving WAF rules, exploit signatures, or comparable detection logic.
• You understand HTTP/HTTPS, how web applications and proxies process requests, and common vulnerability classes such as SQL injection, cross-site scripting, remote code execution, SSRF, and insecure deserialization.
• You can analyze a vulnerability advisory or proof of concept, reproduce the exploit in a controlled environment, and identify the request characteristics that distinguish exploitation from legitimate traffic.
• You use SQL to investigate large datasets and a language such as Python, Go, or Rust to build research tools, automate analysis, and validate detections.
• You make evidence-based tradeoffs between detection coverage, false positives, and performance. You are comfortable investigating ambiguous reports and following issues through to resolution.
• You work effectively with engineers, product partners, and customer-facing teams, and communicate technical findings clearly to both technical and non-technical audiences.
• You use AI fluently in research and coding workflows and have the judgment to know where it accelerates the work and where its outputs need independent validation.
• You are curious about how attackers exploit web applications and bypass defenses. You do not need to know our exact stack, but you should be eager to go deep in the domain.