About the role
Non Karat
Role Title Devops Senior Lead
Help defend the organization and its customers from web based attacks that could cause substantial harm to the companys operations reputation and customers
Conduct detailed analyses and technical evaluations of various Web Application Firewall WAF solution rulesets and functionalities to confirm adherence to agreed baselines and to maximize detection of web API and other trafficbased security threats
Create custom rules and features where needed to augment WAF solutions to be able to meet the agree baseline
Identify and mitigate technical circumventions and evasions of WAF solutions
Develop and implement testing packages to assess the efficacy of various initiatives including WAF Proofs of Concept managed and custom rules new features and solutions
Facilitate the automation of efficacy testing procedures and their integration into Continuous IntegrationContinuous Deployment CICD pipelines
Contribute to DevSecOps and pipeline construction projects
When needed reverseengineer attackers exploits and payloads to devise mitigation rules
Ensuring timely and accurate review and action on all WAF tuning requests
Conducting thorough log analyses to effectively identify and mitigate false positives ensuring optimized WAF rules
Maintaining comprehensive and uptodate documentation for all WAF tuning procedures policies and configurations
Developing and recommending tailored WAF policies and rules for various applications and environments
Proactively identifying and addressing false positives to enhance overall WAF accuracy
Collaborating effectively with crossfunctional teams to integrate WAF solutions seamlessly into existing security infrastructure
Providing expert recommendations for WAF configurations based on best practices and current security requirements
Performing regular assessments and audits of WAF configurations to maintain optimal security posture and compliance with industry standards
Staying informed about the latest web security threats vulnerabilities and trends to ensure continuous enhancement of WAF effectiveness
Ideal Candidate Profile
Extensive experience in WAF management tuning and engineering with a strong understanding of web application security principles
Proven track record of proactively identifying and mitigating false positives to optimize WAF performance
Background in SOC or CSIRT and AppSec or Ethical Hacking demonstrating handson experience for the key responsibilities
Proficiency in log analysis tools and techniques with the ability to identify patterns and anomalies in web traffic
Experience with tools such as Splunk Wireshark or custom scripts to process and analyze logs
Experience with at least three major WAF solutions eg Akamai F5 AWS GCP and an understanding of their unique configurations and capabilities
Strong analytical and problemsolving skills with a keen attention to detail
Excellent communication skills capable of articulating complex security concepts to technical and nontechnical stakeholders
Ability to develop test and recommend WAF policies and rules tailored to specific applications and environments
Experience collaborating with crossfunctional teams to integrate WAF solutions into existing security infrastructure
Competence in maintaining comprehensive documentation for WAF tuning procedures policies and configurations
Extensive experience in configuring WAF solutions to align with best practices and security requirements
A proactive detailoriented individual who thrives in a dynamic fastpaced environment and stays updated with the latest web security threats and trends