Note: The job is a remote job and is open to candidates in USA. WTW is seeking a WAF Engineering Lead to maximise the operational performance and security of its services. The role oversees WAF policy engineering across multi-cloud environments, investigates and mitigates web application threats, supports incidents and change activities, and manages direct reports.
Responsibilities
- Perform analysis and tuning of WAF policies to minimise false positives and false negatives while maintaining an appropriate security posture
- Design, implement, maintain and optimise WAF policies across multi-cloud environments
- Lead the investigation and mitigation of web application attacks, including OWASP Top 10 threats, bot attacks, credential stuffing, scraping, Layer 7 DDoS attacks and other web-based threats
- Develop, maintain and enhance custom WAF rules, managed rule exclusions, rate-limiting policies and bot protection controls
- Support transition of WAF policies from Detection mode to Prevention/Block mode through structured analysis, tuning, testing and stakeholder engagement
- Analyse attack patterns, logs and telemetry to identify emerging threats and implement effective mitigations
- Work closely with application owners, development teams and security stakeholders to ensure secure onboarding and operation of internet-facing applications
- Provide subject matter expertise for web application security, secure application delivery and WAF best practices
- Provide technical leadership to Audit & Compliance, Capacity Management, Lifecycle Management, Vulnerability Management and Risk Management Functions
- Provide leadership during major incidents and drive to quick resolutions
- Provide line management for direct reports
- Point of escalation for areas of accountability
- Coach team members on a proactive basis, raising the team’s overall technical acumen
- Restore service and complete root cause analysis of all incidents, driving actions to mitigate the root cause and remove risk of reoccurrence
- Participate on the Technical Design Authority forum
- Implement changes/POCs to the environment in a controlled manner, with implementation and test plans
Skills
- Bachelor's degree in Computer Science, Engineering, Information Technology strongly preferred, or relevant industry experience in related field
- Minimum 5 years' leadership experience (direct reports) in similar role
- Minimum 5 years' experience in IT or Telecoms industry
- Minimum 5 years' Azure WAF/Network management experience
- Minimum 5 years' Network Security experience
- Demonstrable experience investigating, analysing and resolving WAF false positives and false negatives
- Strong experience implementing WAF solutions in Detection mode and transitioning policies to Prevention/Block mode through appropriate tuning and validation
- Proven experience developing and maintaining custom WAF rules, rule exclusions, rate limiting controls and attack mitigation policies, rather than solely relying on out-of-the-box managed rules
- Extensive knowledge of web application attack vectors, including OWASP Top 10 vulnerabilities, SQL Injection, Cross-Site Scripting (XSS), Remote Code Execution (RCE), bot attacks, credential stuffing and API abuse
- Hands-on experience with attack mitigation, threat analysis and creation of bespoke security controls based on observed attack patterns
- Strong understanding of bot protection technologies, managed rule sets, policy tuning and wider web application security best practices
- Experience with Azure Front Door WAF and Azure Application Gateway WAF in enterprise-scale environments
- Experience working across multi-cloud environments and/or vendor-agnostic WAF platforms
- Experience deploying and managing WAF infrastructure using Terraform or other Infrastructure as Code (IaC) technologies
- Experience supporting large-scale production environments with responsibility for change implementation, incident response and threat mitigation
- Ability to blend creativity, problem solving, and technical skills for refining existing concepts or developing new approaches
- Ability to enable changes in the business processes and ability to work cooperatively with stakeholders and peers is essential
- Ability to work under pressure and to resolve issues effectively
- Excellent interpersonal and communication skills
- Bachelor's degree in Computer Science, Engineering, Information Technology strongly preferred
- Financial Services experience preferred
Benefits
- Annual short-term incentive bonus
- Mental health/emotional wellbeing, including Employee Assistance Program
- Medical insurance, including prescription drug coverage and fertility benefits
- Dental insurance
- Vision insurance
- Health Savings Account
- Commuter Accounts
- Health Care and Dependent Care Flexible Spending Accounts
- Company-paid life insurance
- Supplemental life insurance
- AD&D insurance
- Group accident insurance
- Group critical illness insurance
- Group legal insurance
- Identity theft protection
- Wellbeing program
- Adoption assistance
- Surrogacy assistance
- Auto/home insurance
- Pet insurance
- Other work/life resources
- Paid Holidays
- Annual Paid Time Off, including state/local paid leave where required
- Short-Term Disability
- Long-Term Disability
- Bereavement leave
- FMLA leave
- ADA leave
- Jury Duty leave
- Military Leave
- Parental and Adoption Leave
- Paid Time Off, only included for Washington roles
- Qualified contributory pension plan, if eligible
- 401(k) plan with annual nonelective company contribution
- Non-qualified retirement plans available to senior level colleagues who satisfy the plans’ eligibility requirements
Company Overview