Security Research Analyst, WAF Managed RulesNew$157K–$216K

Our team researches web application attacks and turns that research into protections in Cloudflare’s Web Application Firewall (WAF). We build and maintain managed rules that help protect millions of Internet properties from known vulnerabilities, emerging exploits, and new attack techniques.

What you'll do

• You have hands-on experience in web application security, vulnerability: research, or detection engineering, including writing and improving WAF rules, exploit signatures, or comparable detection logic.

• You understand HTTP/HTTPS, how web applications and proxies process requests,: and common vulnerability classes such as SQL injection, cross-site scripting, remote code execution, SSRF, and insecure deserialization.

• You can analyze a vulnerability advisory or proof of concept, reproduce the: exploit in a controlled environment, and identify the request characteristics that distinguish exploitation from legitimate traffic.

• You use SQL to investigate large datasets and a language such as Python, Go,: or Rust to build research tools, automate analysis, and validate detections.

• You make evidence-based tradeoffs between detection coverage, false: positives, and performance. You are comfortable investigating ambiguous reports and following issues through to resolution.

• You work effectively with engineers, product partners, and customer-facing: teams, and communicate technical findings clearly to both technical and non-technical audiences.

What they're looking for

• You have hands-on experience in web application security, vulnerability: research, or detection engineering, including writing and improving WAF rules, exploit signatures, or comparable detection logic.
• You understand HTTP/HTTPS, how web applications and proxies process requests,: and common vulnerability classes such as SQL injection, cross-site scripting, remote code execution, SSRF, and insecure deserialization.
• You can analyze a vulnerability advisory or proof of concept, reproduce the: exploit in a controlled environment, and identify the request characteristics that distinguish exploitation from legitimate traffic.
• You use SQL to investigate large datasets and a language such as Python, Go,: or Rust to build research tools, automate analysis, and validate detections.
• You make evidence-based tradeoffs between detection coverage, false: positives, and performance. You are comfortable investigating ambiguous reports and following issues through to resolution.
• You work effectively with engineers, product partners, and customer-facing: teams, and communicate technical findings clearly to both technical and non-technical audiences.
• You use AI fluently in research and coding workflows and have the judgment to: know where it accelerates the work and where its outputs need independent validation.
• You are curious about how attackers exploit web applications and bypass: defenses. You do not need to know our exact stack, but you should be eager to go deep in the domain.