Cloud Security Engineer- Cloudflare WAF

Role & responsibilities

Detailed Job Description

Cloudflare WAF Management

• Design, implement, and manage Cloudflare WAF policies across enterprise applications
• Tune managed rulesets, custom rules, and rate-limiting policies to minimize false positives
• Monitor, analyze, and respond to WAF security events and incidents
• Implement protection against OWASP Top 10 threats, DDoS attacks, bot abuse, and API threats
• Coordinate with application teams to onboard new applications to Cloudflare securely

CDN & Performance Optimization

• Manage Cloudflare CDN configurations for optimal performance and availability
• Configure caching strategies, page rules, and traffic routing policies
• Troubleshoot latency, caching, and origin connectivity issues
• Support global traffic management and high-availability architectures

Cloudflare Workers & Edge Logic

• Develop and maintain Cloudflare Workers for edge-based logic, request validation, and traffic manipulation
• Implement Workers for security use cases such as header validation, token checks, redirects, and API protection
• Collaborate with developers to deploy and manage Workers in CI/CD pipelines

Security Operations & Governance

• Integrate Cloudflare logs with SIEM/SOC tools for monitoring and alerting
• Perform regular security reviews, audits, and compliance checks
• Create documentation, runbooks, and operational procedures for WAF and edge security
• Stay current with Cloudflare features, threat intelligence, and industry best practices

Required Skills & Qualifications

• Experience in web security, network security, or cloud security
• Strong hands-on experience with Cloudflare WAF, CDN, and security products
• Solid understanding of HTTP/HTTPS, TLS, DNS, and web application architecture
• Experience managing WAF rules, rate limiting, bot management, and DDoS protection
• Working knowledge of Cloudflare Workers (JavaScript)
• Experience integrating security logs with tools (Splunk,S3.)
• Familiarity with OWASP Top 10, API security, and Zero Trust concepts