Security Research Analyst, WAF Managed Rules

Cloudflare

. Research public CVEs, proof-of-concept exploits, observed attacks, threat intelligence, customer reports, and internal telemetry .

Posted 10/27/2026full-timeUnited StatesMid-LevelSenior💰 $150,000 - $216,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in web application security, vulnerability research, and detection engineering, with a strong focus on writing and improving WAF rules and exploit signatures. Proficient in analyzing vulnerabilities, collaborating with cross-functional teams, and effectively communicating technical findings to diverse audiences.

Highest-signal resume keywords

Web Application SecurityWAF Rule DevelopmentSQL ExperiencePython ProgrammingVulnerability Analysis

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

WAF RulesExploit SignaturesVulnerability ResearchPenetration TestingExploit AnalysisHTTP/HTTPSSQL InjectionCross-Site ScriptingRemote Code ExecutionInsecure Deserialization

Soft Skills

CollaborationCuriosityCommunication

Tools & Technologies

PythonGoRustClickHouseGrafanaLinux/UNIXTCP/IPModSecurityOWASP Core Rule SetAutomated Testing Environments

Industry Keywords

CVE ResearchThreat IntelligenceExploit ChainsFalse Positive AnalysisSecurity AnalyticsBug Bounty ProgramsCTFsData ScienceMachine LearningSecurity Research

Tech Stack

Tools & technologies

GrafanaLinuxPythonRustSQLTCP/IPUnixGo

About the role

Key responsibilities & impact

Research public CVEs, proof-of-concept exploits, observed attacks, threat intelligence, customer reports, and internal telemetry
Understand vulnerability root causes, exploit chains, and WAF mitigation opportunities
Design, test, deploy, and maintain WAF managed rules and exploit signatures
Investigate customer-reported false positives and missed attacks using request telemetry
Reproduce issues and refine detections to improve protection without unnecessarily blocking legitimate traffic
Conduct targeted penetration testing, exploit-variant testing, and adversarial testing to identify detection gaps and bypass resistance
Build tools and reproducible test cases for exploit analysis, rule validation, regression testing, and traffic analysis
Use SQL, dashboards, and production data to measure rule efficacy, attack trends, coverage, false-positive rates, and performance
Collaborate with Engineering, Product, and detection teams to deliver reliable protections and resolve recurring customer problems
Document findings, explain mitigation decisions, and contribute to internal research reports and public-facing blogs

Requirements

What you’ll need

Hands-on experience in web application security, vulnerability research, or detection engineering, including writing and improving WAF rules, exploit signatures, or comparable detection logic
Understanding of HTTP/HTTPS, web application and proxy request processing, and vulnerability classes including SQL injection, cross-site scripting, remote code execution, SSRF, and insecure deserialization
Ability to analyze vulnerability advisories or proof-of-concept exploits, reproduce exploits in controlled environments, and distinguish exploitation from legitimate traffic
SQL experience for investigating large datasets
Experience with Python, Go, or Rust for research tools, automated analysis, and detection validation
Evidence-based tradeoff assessment among detection coverage, false positives, and performance
Ability to investigate ambiguous reports and follow issues through resolution
Ability to collaborate with engineers, product partners, and customer-facing teams and communicate technical findings clearly to technical and non-technical audiences
Fluent use of AI in research and coding workflows with independent validation judgment
Curiosity about web application exploitation and bypassing defenses
Additional valued experience: WAF rules or open-source WAF projects such as ModSecurity or OWASP Core Rule Set; WAF bypasses; request parsing and encoding; large-scale security analytics; advanced SQL; ClickHouse; Grafana; automated exploit-reproduction environments; detection test suites; CI pipelines; Linux/UNIX; TCP/IP; reverse proxies; production traffic performance; published security research; conference presentations; open-source security tools; bug bounty programs; CTFs; data science or machine learning partnerships

Benefits

Comp & perks

Equity plan participation
Medical/Rx Insurance
Dental Insurance
Vision Insurance
Flexible Spending Accounts
Commuter Spending Accounts
Fertility & Family Forming Benefits
On-demand mental health support and Employee Assistance Program
Global Travel Medical Insurance
Short and Long Term Disability Insurance
Life & Accident Insurance
401(k) Retirement Savings Plan
Employee Stock Participation Plan
Flexible paid time off covering vacation and sick leave
Leave programs, including parental, pregnancy health, medical, and bereavement leave