Senior Web Application Firewall Engineer (Cybersecurity)

Location: US, Remote

Base salary: $195,000–$230,000 for Tier 1; $175,000–$207,000 for Tier 2. Full-time roles are also eligible for equity in the form of stock options.

Company

hirify.global is a remote cybersecurity product company developing NodeZero, a platform for production-safe autonomous penetration testing and security assessment operations across internal, external, cloud, and hybrid cloud environments.

What you will do

• Partner with Product to turn WAF effectiveness and tuning goals into concrete requirements and prioritized outcomes.
• Define acceptance criteria for detection, effectiveness, and tuning features, and validate releases before customer delivery.
• Serve as the domain reference for Engineering and AI research on WAF behavior, vendor capabilities, and design questions.
• Maintain current knowledge of AWS WAF, Cloudflare WAF, F5 Advanced WAF, Imperva, Akamai App & API Protector, FortiWeb, and ModSecurity with OWASP CRS.
• Define equivalent vendor-specific rule semantics across web ACLs, rule groups, security policies, signature sets, and rule chains.
• Evaluate remediation recommendations against validated exploits, realistic payload variants, legitimate traffic preservation, and current adversary tradecraft.

Requirements

• 5+ years in application security, security engineering, security operations, incident response, or threat hunting, including 2+ years administering and tuning WAF platforms in production.
• Hands-on production experience with WAF platforms, including custom rules, managed rule groups, rate-based rules, exclusions, and count-to-block rollouts.
• Deep understanding of how AppSec and SOC teams use WAF outcomes and request logs for triage, containment, and investigation.
• Strong understanding of false-positive and false-negative tradeoffs, permissive rules and exclusions, application-availability risks, policy effectiveness, and coverage.
• Working knowledge of the OWASP Top 10, MITRE ATT&CK including T1190, and application-control coverage frameworks.
• Understanding of web attacks in HTTP requests and WAF telemetry, including public-facing application exploitation, injection, credential stuffing, bot abuse, and API abuse.
• Experience shaping a product or platform as a security domain expert and influencing without direct authority.
• Exceptional technical writing and the ability to translate between engineers, AI researchers, product managers, SOC analysts, and executives.
• Scripting ability, ideally Python, for querying APIs, inspecting telemetry, and prototyping analyses, plus comfort with SQL and large event datasets.

Nice to have

• Experience with any of the listed WAF platforms, including AWS WAF, Cloudflare WAF, F5 Advanced WAF, Imperva, Akamai App & API Protector, FortiWeb, or ModSecurity with OWASP CRS.

Culture & Benefits

• 100% remote work with a culture focused on respect, collaboration, ownership, and results.
• Health, vision, and dental insurance for employees and their families.
• Flexible vacation policy and generous parental leave.
• Equity through stock options, professional growth opportunities, and an inclusive workplace.