Network Security Engineer (WAF & DDoS)

About the role

The Network Security Engineer (WAF & DDoS) designs, implements, operates and continuously improves Web Application Firewall and DDoS protection across internet-facing services, applications and APIs. The engineer builds resilient edge-security controls that protect the confidentiality, integrity and availability of critical payment and digital services, working with Network, Cloud, Application, Architecture and Security Operations teams.

Key responsibilities

• Define the target-state architecture for WAF, DDoS and edge security across on-premises, cloud and hybrid environments, including reverse proxies, CDNs, DNS security, bot management, API protection and rate limiting.
• Assess proposed network, cloud, application and API changes for WAF, DDoS and availability implications, and contribute to architecture reviews, threat modelling and technology selection.
• Onboard applications and APIs to WAF and DDoS services, design policies, run security testing and production cutover, then support post-implementation operations.
• Implement WAF policies (managed rule sets, custom signatures, virtual patching, IP and file restrictions, API schema validation, rate limiting) and controls against volumetric, protocol-based and application-layer DDoS attacks, including traffic diversion, clean-pipe and scrubbing arrangements.
• Configure TLS certificates, cipher suites, protocols and trusted proxy headers, and maintain secure configuration baselines for WAF, DDoS and CDN platforms.
• Monitor WAF, CDN and DDoS telemetry, establish baselines and detection thresholds, and integrate logs and alerts with Microsoft Sentinel or the relevant SIEM and SOC workflows.
• Lead incident response for web, API and DDoS incidents, coordinate with carriers and vendors, and turn lessons learned into improved controls and response procedures.
• Tune WAF and DDoS policies to reduce false positives, implement virtual patches and compensating controls, and review security exceptions.
• Maintain service availability, capacity assumptions, failover procedures and runbooks, and support failover testing, DDoS simulations and planned maintenance.
• Automate repeatable tasks such as policy deployment, configuration validation and health checks.

Required profile

• Experienced network security engineer combining strong technical capability with disciplined change management, testing, documentation and risk management.
• Ability to work in a regulated, highly available environment without creating unacceptable customer or service impact.