Cloudflare
Security Research Analyst, WAF Managed Rules
$150K–$216K
Hybrid +3 · Full-time · Posted Oct 27, 2026
- Location
- Hybrid
Austin, TX, United States
New York, New York, United States
San Francisco, CA, United States - Visa sponsorship
- An offer may be conditioned on authorization to receive software or technology controlled under U.S. export laws without sponsorship for an export license.
About the job
Research web application threats and develop, test, and improve WAF managed rules that protect customers while minimizing false positives and performance impact.
What you'll do
- Analyze vulnerabilities, exploits, attack telemetry, and customer reports to identify mitigation opportunities.
- Design, deploy, and validate WAF rules; investigate false positives, missed attacks, and bypasses.
- Automate research and testing, measure rule effectiveness using production data, and collaborate on and document protections.
What they ask for
- Hands-on experience in web application security, vulnerability research, or detection engineering, including writing or improving WAF rules, exploit signatures, or comparable detection logic.
- Knowledge of HTTP/HTTPS, web application and proxy request processing, and common vulnerability classes.
- Ability to analyze and reproduce exploits and distinguish malicious requests from legitimate traffic.
- SQL skills and a language such as Python, Go, or Rust for research tools, analysis, and detection validation.
Nice to have
- Experience developing WAF rules or contributing to open-source WAF projects such as ModSecurity or the OWASP Core Rule Set.
- Experience with WAF bypasses, large-scale security analytics, automated exploit-reproduction or detection testing, or security research publications and projects.
Pay
$157,000 - $216,000 USD annual base salary (San Francisco); $150,000 - $206,000 USD annual base salary (New York City)
Tools
SQL, Python, Go, Rust, ModSecurity, OWASP Core Rule Set, ClickHouse, Grafana
AI focus
Use AI fluently in research and coding workflows, applying judgment to validate its outputs independently.
Model-written summary · the original posting is authoritative