Web Security Engineer

About the role

We are seeking a Web Security Engineer to protect our internet‑facing applications, APIs and digital channels from cyber threats. You will work closely with development and operations teams to embed security controls into web services while supporting business projects and day‑to‑day operational security.

Key responsibilities

• Design, implement and maintain web security controls, including Web Application Firewall (WAF) policies.
• Investigate and mitigate web‑based attacks such as OWASP Top 10, bot traffic, DDoS, credential stuffing and scraping.
• Analyze security events from websites, APIs and customer‑facing services.
• Perform security reviews of web application architectures and proposed changes.
• Support onboarding and configuration of CDN and related security services.
• Develop and improve detection logic, automated protections and security rules.
• Collaborate with application teams to remediate identified vulnerabilities.
• Conduct security assessments and provide risk‑reduction recommendations.
• Participate in incident response for web security incidents.

Required profile

• Strong understanding of web application security concepts and OWASP Top 10.
• Experience with WAF and CDN platforms (e.g., Cloudflare, Akamai).
• Solid knowledge of API security, HTTP/HTTPS, and networking fundamentals (TCP/IP, DNS, load balancing, reverse proxies).
• Ability to analyze web attack patterns and security logs.

Required skills

• Web Application Firewall (WAF)
• CDN platforms (Cloudflare, Akamai)
• API security
• HTTP/HTTPS protocols
• TCP/IP, DNS, load balancing, reverse proxies
• OWASP Top 10
• Terraform / Infrastructure as Code
• Azure DevOps or CI/CD pipelines
• Python, PowerShell, Bash scripting