Security Research Analyst (WAF)

Location: Hybrid in Austin, Texas; San Francisco, California; or New York City, United States. Offer-stage candidates may be asked to attend an in-person interview at a hirify.global office or hub.

Estimated annual salary: $157,000–$216,000 for San Francisco hires; $150,000–$206,000 for New York City hires.

Company

hirify.global operates a global network and security platform that protects and accelerates Internet applications, websites, and other Internet properties.

What you will do

• Research public CVEs, proof-of-concept exploits, threat intelligence, customer reports, and observed attacks to identify WAF mitigation opportunities.
• Design, test, deploy, and maintain managed WAF rules and exploit signatures.
• Investigate false positives, missed attacks, customer reports, and request telemetry; reproduce issues and refine detections.
• Validate coverage and resistance to bypasses through penetration testing, exploit variants, adversarial testing, and regression testing.
• Build research tools, automated test cases, and reproducible exploit-analysis environments; use SQL, dashboards, and production data to measure detection quality.
• Collaborate with Engineering, Product, detection teams, and customer-facing teams; document findings and contribute to internal reports and public-facing research.

Requirements

• Hands-on experience in web application security, vulnerability research, or detection engineering, including writing and improving WAF rules, exploit signatures, or comparable detection logic.
• Understanding of HTTP/HTTPS, web application and proxy request processing, and vulnerability classes including SQL injection, cross-site scripting, remote code execution, SSRF, and insecure deserialization.
• Ability to analyze vulnerability advisories or proof-of-concept exploits, reproduce exploits in controlled environments, and distinguish exploitation requests from legitimate traffic.
• Experience using SQL to investigate large datasets and Python, Go, or Rust to build research tools, automate analysis, and validate detections.
• Ability to make evidence-based tradeoffs between detection coverage, false positives, and performance, investigate ambiguous reports, and follow issues through resolution.
• Ability to collaborate with engineers, product partners, and customer-facing teams and communicate technical findings to technical and non-technical audiences.
• Fluent use of AI in research and coding workflows, with independent validation of AI-generated outputs.
• Curiosity about web application exploitation and bypassing defenses; exact familiarity with hirify.global's stack is not required.

Nice to have

• Experience developing WAF rules or contributing to ModSecurity or the OWASP Core Rule Set.
• Experience finding WAF bypasses, analyzing request parsing and encoding differences, or researching novel exploitation techniques.
• Experience with large-scale security analytics, advanced SQL, ClickHouse, and Grafana.
• Experience building automated exploit-reproduction environments, detection test suites, or CI pipelines for security rules.
• Familiarity with Linux/UNIX systems, TCP/IP networking, reverse proxies, and production traffic inspection performance constraints.
• Published security research, conference presentations, open-source security tools, bug bounty work, or CTF experience.
• Experience partnering with data science or machine learning teams to combine rule-based detections with other security signals.

Culture & Benefits

• Hybrid work environment with available locations in Austin, San Francisco, and New York City.
• Medical/Rx, dental, vision, flexible spending, commuter, fertility and family-forming benefits, and mental health support.
• Global travel medical insurance, disability and life insurance, 401(k), and employee stock participation plan.
• Flexible paid time off covering vacation and sick leave, plus parental, pregnancy, medical, and bereavement leave.
• Equity plan eligibility and an emphasis on curiosity, iteration, collaboration, and protecting the free and open Internet.

Hiring process

• Candidates progressing to the offer stage may be asked to attend an in-person interview at a hirify.global office or hub.
• Any offer may be conditioned on authorization to receive software or technology controlled under U.S. export laws without sponsorship for an export license.