Role Overview:The Senior Imperva WAF Engineer will be responsible for designing, implementing, and managing Imperva WAF security policies to protect internet-facing web applications and APIs. This role involves continuous tuning of WAF rules to mitigate threats, providing Level 3 support for incidents, and analyzing web traffic and security logs to identify malicious activity.
Key Responsibilities:- Design, implement, and manage Imperva WAF security policies for web applications and APIs.
- Configure and continuously tune Imperva WAF rules, security policies, and exceptions.
- Provide Level 3 support for WAF-related incidents, troubleshooting blocked requests and access issues.
- Analyze web traffic, WAF events, and security logs to identify and investigate malicious activity.
- Configure and manage protections against common web application threats like SQL injection, XSS, bots, and DDoS.
- Support application onboarding to Imperva WAF, including DNS, SSL/TLS, and policy validation.
- Utilize infrastructure-as-code tools, specifically Terraform and Imperva APIs, for automation.
- Collaborate with application, network, cloud, and security operations teams.
- Develop and maintain operational procedures, configuration standards, and documentation.
- Monitor emerging web application threats and update Imperva security policies accordingly.
Required Skills:- Extensive experience with Imperva WAF, including configuration, management, and tuning of security policies.
- Proficiency in creating and managing WAF rules, exceptions, access controls, rate-limiting, and bot protection.
- Strong understanding of web application vulnerabilities and attack vectors (OWASP Top 10, SQL injection, XSS, DDoS).
- Experience troubleshooting false positives, blocked requests, and WAF-related performance issues.
- Hands-on experience with Terraform and familiarity with Imperva APIs for automation.
- Experience analyzing security logs and integrating WAF events with SIEM platforms like Splunk.
- Proficiency in scripting or programming languages such as Python or Bash.
- Experience with public cloud platforms (AWS, Azure, Google Cloud) and their native security services.
- Familiarity with CI/CD pipelines, change management, and version control systems like Git.
- Strong understanding of network protocols and web technologies (HTTP/HTTPS, SSL/TLS, DNS).
- Skills in Cloud Security Management, Incident Management, and Policy Administration.
Qualifications:- At least 7 years of hands-on experience in web application security, with a significant focus on WAF administration.
- Understanding of internet-facing application performance, including latency, caching, HTTP/2, and TLS.
