Security Research Analyst, WAF Managed Rules

Researches web application attacks and turns them into managed rules for Cloudflare's Web Application Firewall, which protects millions of internet properties. The analyst studies CVEs, proof-of-concept exploits and observed attacks, reproduces them, and designs, tests and ships rules and signatures that block exploitation while sparing legitimate traffic.

The work also covers investigating false positives and missed attacks, hunting for rule bypasses, building automated validation and regression tooling, measuring rule quality with SQL and production data, and writing research for internal reports and public blogs. Candidates need hands-on web security, vulnerability research or detection engineering, a strong grasp of HTTP and common vulnerability classes, SQL, and Python, Go or Rust.