Web Application Firewall Engineer

Role: WAF Engineer

Exp: 10+ years

Location: Hyderabad

Mode: Remote

• Consult with Capability Lead to deliver Web Application and API Protection for our critical applications, primarily on the Akamai platform.
• Monitor and review all tuning requests.
• Conduct detailed log analysis to identify false positives and optimize WAF rules for improved accuracy and performance.
• Create and maintain comprehensive documentation for WAF tuning, tuning procedures, policies, and configurations.
• Develop, test, and recommend WAF policies and rules tailored to specific applications and environments.
• Proactively assist with identifying false positives.
• Collaborate with cross-functional teams to ensure seamless integration of WAF solutions into existing security infrastructure.
• Collaborate with Application teams to enable web application protection.
• Deliver anti-bypass protection for on‑premise application currently using Akamai.
• Provide recommendations for WAF configuration based on best practices and security requirements.
• Perform regular assessments and audits of WAF configurations to ensure optimal security posture and compliance with industry standards.
• Maintain evidence for audit and regulatory asks.
• Deliver monthly / quarterly business reviews for application owners to show the effectiveness of the WAF control.
• Stay updated with the latest web security threats, vulnerabilities, and trends to continually enhance WAF effectiveness.
• Evaluate, design, and deliver new and alternative WAAP features and/or solutions.

• Ensuring alignment with capability lead and control owner to deliver consistent WAAP policies across multiple infrastructures.
• Ensuring timely and accurate review and action on all WAF tuning requests.
• Conducting thorough log analyses to effectively identify and mitigate false positives, ensuring optimized WAF rules.
• Maintaining comprehensive and up‑to‑date documentation for all WAF tuning procedures, policies, and configurations.
• Developing and recommending tailored WAF policies and rules for various applications and environments.
• Proactively identifying and addressing false positives to enhance overall WAF accuracy.
• Collaborating effectively with cross‑functional teams to integrate WAF solutions seamlessly into existing security infrastructure.
• Collaborating effectively with application teams to enable WAF protection across HSBC.
• Ensuring connectivity to origin servers on premise only comes through Akamai to prevent direct to origin attacks.
• Providing expert recommendations for WAF configurations based on best practices and current security requirements.
• Performing regular assessments and audits of WAF configurations to maintain optimal security posture and compliance with industry standards and maintaining evidence.
• Performing service reviews with accountable service / application owners.
• Staying informed about the latest web security threats, vulnerabilities, and trends to ensure continuous enhancement of WAF effectiveness.
• Reviewing existing and new solutions to deliver best in class protections.

• Extensive experience in WAF management, tuning, and engineering, with a strong understanding of web application security principles.
• Proven track record of proactively identifying and mitigating false positives to optimize WAF performance.
• Background in SOC or CSIRT environments, demonstrating hands‑on experience in in-depth log analysis.
• Proficiency in log analysis tools and techniques, with the ability to identify patterns and anomalies in web traffic.