Role:F5 WAF Lead Engineer
Location: Remote
Key Responsibilities
Define and lead the strategy for transitioning from broad WAF rules to per-application, tailored security policies across a large application portfolio.
Design and build an AI-assisted policy development workflow using scan output, traffic data, and application configuration to recommend and generate tailored WAF policies at scale.
Evaluate, recommend, and implement F5 Distributed Cloud (XC) WAAP policies on an application-by-application basis.
Integrate findings from vulnerability and penetration testing tools into the policy development process.
Partner directly with client cybersecurity leadership to define deliverables, direction, and rollout milestones.
Establish repeatable methodology and documentation so the practice can scale as volume grows and the team expands.
Support and mentor additional team members as the engagement scales.
Troubleshoot complex WAF policy, traffic, and security issues across cloud-hosted environments.
Support incident response and root cause analysis for WAF/application security events.
Coordinate change management and production deployment windows for policy rollouts.
Required Qualifications
5+ years of experience in web application firewall engineering, with strong hands-on expertise in F5 Distributed Cloud (XC) WAAP.
Demonstrated experience designing and implementing custom, per-application WAF policies (not just baseline/default rule sets).
Experience conducting web application vulnerability assessment and remediation.
Strong understanding of OWASP Top 10 and emerging web application threats.
Experience leveraging AI/automation tooling to scale security operations (policy generation, evaluation, or triage).
Ability to operate as both a strategic lead (defining direction, engaging client stakeholders) and a hands-on implementer.
Experience with F5 Silverline and/or BIG-IP ASM/Advanced WAF (prior-generation context).
Familiarity with cloud-hosted application architectures.
Excellent communication skills able to present strategy and status to client security leadership.