Application Security Engineer (WAF)

Location: Poland (must be based in Poland)

Engagement: Full time B2B (9am-5pm CET)

Duration: 6 months initially, view to extend

Role overview

We are seeking a WAF and Application Security SME to strengthen protection for globally distributed web applications and APIs across data centre and cloud environments. The role focuses on improving WAF effectiveness through custom rules, security testing, detailed log analysis and policy tuning.

You will assess how effectively WAF solutions detect and prevent attacks, address configuration and security coverage gaps, and reduce false positives. You will also help automate security testing and integrate it into CI/CD pipelines, working with security, application and engineering teams.

Key responsibilities

• Develop, test and recommend complex custom WAF rules, policies and features tailored to application requirements and agreed security baselines.
• Analyse WAF rulesets and capabilities to identify gaps in protection against web, API and other traffic-based security threats.
• Design and execute effectiveness tests for baseline and custom rules, proofs of concept, new features and WAF solutions.
• Automate WAF effectiveness testing and integrate test packages into CI/CD pipelines; contribute to DevSecOps and pipeline development.
• Provide specialist advice on web and API attack methods, WAF evasion techniques and appropriate mitigations.
• Where required, reverse-engineer attacker exploits and payloads to develop mitigation rules.
• Monitor and review WAF tuning requests, analyse logs and identify patterns, anomalies and false positives.
• Tune policies and configurations to improve detection accuracy and performance while maintaining effective protection.
• Collaborate with cross-functional teams to integrate WAF solutions into the wider security infrastructure.
• Maintain documentation covering WAF policies, rules, configurations and tuning procedures.
• Perform regular configuration assessments and audits against security requirements, agreed baselines and applicable industry standards.
• Keep up to date with emerging web security threats, vulnerabilities and mitigation techniques.

Required experience and skills

• Extensive hands-on experience in WAF engineering, management and tuning, with a strong understanding of web application security.
• Experience with at least two major WAF solutions, such as Akamai, F5, AWS or GCP, including their configurations and capabilities.
• A background in SOC or CSIRT, combined with application security or ethical hacking experience.
• Proven experience identifying and mitigating false positives through detailed log analysis and WAF policy tuning.
• Experience developing custom WAF rules and policies for specific applications and environments.
• An understanding of web and API attacks, malicious payloads, WAF bypass techniques and mitigation approaches.
• Experience testing WAF effectiveness, evaluating rulesets and assessing new solutions or features.
• Experience automating security testing and integrating it into CI/CD pipelines, with the ability to contribute to DevSecOps activities.
• Proficiency in log analysis tools and techniques, using tools such as Splunk, Wireshark or custom scripts.
• Experience assessing WAF configurations against security requirements and best practices.
• Strong analytical and troubleshooting skills, with close attention to detail.
• Clear communication with technical and non-technical stakeholders, and experience collaborating across security, application and engineering teams.
• Ability to maintain accurate technical documentation and proactively recommend improvements to security posture.