WAF Engineer

As a WAF Engineer, you will maximise the performance and security of WTW’s web delivery by tuning and enforcing WAF policies across multi-cloud environments. You’ll lead investigation and mitigation of web application threats, collaborating with application owners and security stakeholders to ensure secure onboarding and operation of internet-facing apps. The role combines hands-on policy design, incident support, and change governance to sustain a strong security posture in a 24/7/365 NOC setting. This position offers strategic impact on enterprise web security and thrives in a fast-paced, cross-functional environment.

• 25 days annual leave
• private healthcare
• life insurance
• defined contribution pension (matched up to 10%)
• hybrid working
• volunteer day

• Analyze and tune WAF policies to reduce false positives/negatives while maintaining security
• Design, implement, maintain and optimise WAF policies across multi-cloud environments
• Lead investigation and mitigation of web application attacks (OWASP Top 10, bot attacks, credential stuffing, DDoS)
• Develop and enhance custom WAF rules, exclusions, rate-limiting and bot protection controls
• Support transition of WAF policies from Detection to Prevention/Block mode with testing and stakeholder engagement
• Analyze attack patterns and telemetry to identify threats and implement mitigations
• Collaborate with application owners and development teams for secure onboarding of internet-facing apps
• Provide technical leadership during major incidents and drive quick resolutions
• Conduct root-cause analysis post-incidents and implement corrective actions
• Participate in Technical Design Authority discussions and manage changes/POCs with plans

• Demonstrable expertise in investigating WAF false positives/negatives
• Strong experience in WAF deployment in Detection mode and transition to Prevention/Block
• Proven ability to develop and maintain custom WAF rules and mitigation policies
• Extensive knowledge of OWASP Top 10, SQLi, XSS, RCE, bot attacks, credential stuffing, API abuse
• Hands-on attack mitigation, threat analysis, and bespoke security controls
• Strong understanding of bot protection technologies, managed rule sets and best practices
• Experience with Azure Front Door WAF and Azure Application Gateway WAF in enterprise environments
• Multi-cloud or vendor-agnostic WAF experience
• IaC expertise with Terraform or similar tools
• Ability to support large production environments with change, incident response and threat mitigation
• Communication and stakeholder management skills
• Knowledge of Azure Firewall, Palo Alto/ Cisco security solutions advantageous

• Stakeholder management
• Effective communication
• Collaborative mindset
• WAF policy design and tuning
• Custom WAF rules and rate-limiting
• Attack mitigation and telemetry analysis