Web Security Engineer

About the role

The company is looking for a Web Security Engineer to support and provide technical expertise for securing internet-facing applications and services. The role protects web applications, APIs and digital channels against cyber threats while supporting business projects and operational security activities.

Key responsibilities

• Design, implement and maintain web security controls
• Manage and optimise Web Application Firewall (WAF) policies
• Investigate and mitigate web-based attacks such as OWASP Top 10, bot attacks, DDoS, credential stuffing and scraping
• Analyse security events related to websites, APIs and customer-facing services
• Review web application architectures and proposed changes from a security perspective
• Support onboarding and configuration of CDN and security services
• Develop and improve security rules, detection logic and automated protections
• Work with application teams to remediate vulnerabilities
• Carry out security assessments and support incident response for web security incidents

Required profile

• At least 3+ years of experience as a Web Security Engineer
• Strong understanding of web application security concepts
• Good understanding of networking fundamentals (TCP/IP, DNS, load balancing, reverse proxies)
• Ability to troubleshoot complex web security issues
• On-call participation required for critical incidents and platform disruption; standard business hours

Required skills

• Web Application Firewalls (WAF)
• CDN platforms (Cloudflare, Akamai or similar)
• API security and HTTP/HTTPS protocols
• OWASP Top 10 and secure development principles
• Nice to have: Cloudflare Enterprise, Terraform, Azure DevOps or CI/CD, Python, PowerShell or Bash scripting