Jobs → Engineering → WAF Engineer - Information Security

About the Role We are seeking a WAF Engineer - Information Security to join our team in Atlanta, GA. This is a 6+ months contract role focused on protecting internet-facing web applications and APIs. Key Responsibilities • Design, implement, and manage Imperva WAF security policies to protect internet-facing web applications and APIs • Configure and continuously tune Imperva WAF rules, security policies, and exceptions to mitigate threats while minimizing false positives and business impact • Provide Level 3 support for WAF-related incidents and operational issues, including troubleshooting blocked requests, application access issues, SSL/TLS errors, and connectivity problems • Analyze web traffic, WAF events, and security logs to identify malicious activity, investigate incidents, and recommend appropriate mitigation measures • Configure and manage protections for common web application threats, including SQL injection, cross-site scripting, malicious bots, and distributed denial-of-service (DDoS) attacks • Support application onboarding to Imperva WAF, including DNS configuration, SSL/TLS certificate management, origin connectivity, and validation of security policies • Use infrastructure-as-code tools, particularly Terraform, and Imperva APIs to automate supported configurations and improve operational consistency • Collaborate with application, network, cloud, and security operations teams to align WAF policies with application requirements and security standards • Develop and maintain operational procedures, configuration standards, troubleshooting guides, and change documentation • Monitor emerging web application threats and update Imperva security policies and controls accordingly Requirements • At least 7 years of hands-on experience in web application security, with a significant focus on WAF administration and security policy management • Extensive experience with Imperva WAF, including configuring, managing, and tuning security policies for production applications • Experience creating and managing WAF rules and exceptions, access controls, rate-limiting policies, and bot protection controls • Strong understanding of web application vulnerabilities and attack vectors, including the OWASP Top 10, SQL injection, cross-site scripting, and DDoS attacks • Experience troubleshooting false positives, blocked requests, application availability, and WAF-related performance issues • Understanding of internet-facing application performance, including latency, caching, HTTP/2, and TLS