Security Research Analyst, WAF Managed Rules

About the Role

We are looking for a Security Research Analyst to research web application threats and develop the managed rules that protect Cloudflare customers. You will turn public CVEs, threat intelligence, customer reports, and internal telemetry into tested, effective mitigations.

Responsibilities

• Research vulnerabilities and exploitation. Analyze public CVEs, proof-of-concept exploits, and observed attacks to understand root causes, exploit chains, and opportunities for WAF mitigation.
• Develop and maintain managed rules. Design, test, and deploy WAF managed rules and exploit signatures, keeping protections effective as applications, exploits, and attacker techniques evolve.
• Investigate false positives and missed attacks. Analyze customer reports and request telemetry, reproduce issues, and refine detections to improve protection without unnecessarily blocking legitimate traffic.
• Validate coverage and resistance to bypasses. Use targeted penetration testing, exploit variants, and adversarial testing to identify detection gaps and evaluate proposed mitigations.
• Automate research and validation. Build tools and reproducible test cases that accelerate exploit analysis, rule validation, regression testing, and traffic analysis.
• Measure detection quality. Use SQL, dashboards, and production data to assess rule efficacy, track attack trends, and guide improvements to coverage, false-positive rates, and performance.
• Collaborate across teams. Partner with Engineering, Product, and other detection teams to deliver reliable protections and resolve recurring customer problems at their roots.
• Share actionable research. Document findings, explain mitigation decisions, and contribute to internal research reports and public-facing blogs on vulnerabilities and Internet-wide attack trends.

Requirements

• Hands-on experience in web application security, vulnerability research, or detection engineering, including writing and improving WAF rules, exploit signatures, or comparable detection logic.
• Understanding of HTTP/HTTPS, how web applications and proxies process requests, and common vulnerability classes such as SQL injection, cross-site scripting, remote code execution, SSRF, and insecure deserialization.
• Ability to analyze a vulnerability advisory or proof of concept, reproduce the exploit in a controlled environment, and identify the request characteristics that distinguish exploitation from legitimate traffic.
• Proficiency in SQL to investigate large datasets and a language such as Python, Go, or Rust to build research tools, automate analysis, and validate detections.
• Evidence-based tradeoffs between detection coverage, false positives, and performance.
• Comfortable investigating ambiguous reports and following issues through to resolution.
• Effective collaboration with engineers, product partners, and customer-facing teams, and clear communication of technical findings to both technical and non-technical audiences.
• Fluent use of AI in research and coding workflows and judgment to know where it accelerates the work and where its outputs need independent validation.
• Curiosity about how attackers exploit web applications and bypass defenses.

Nice to Have

• Experience developing WAF rules or contributing to open-source WAF projects, such as ModSecurity or the OWASP Core Rule Set.
• Experience finding WAF bypasses, analyzing request parsing and encoding differences, or researching novel exploitation techniques.
• Experience with large-scale security analytics, advanced SQL, columnar databases such as ClickHouse, and visualization tools such as Grafana.
• Experience building automated exploit-reproduction environments, detection test suites, or CI pipelines for security rules.
• Familiarity with Linux/UNIX systems, TCP/IP networking, reverse proxies, and the performance constraints of inspecting production traffic.
• Published security research, conference presentations, open-source security tools, or demonstrated work through bug bounty programs or CTFs.
• Experience partnering with data science or machine learning teams to combine rule-based detections with other security signals.

Compensation

• For San Francisco based hires: Estimated annual salary of $157,000 - $216,000
• For New York City based hires: Estimated annual salary of $150,000 - $206,000

Benefits

• Medical/Rx Insurance
• Dental Insurance
• Vision Insurance
• Flexible Spending Accounts
• Commuter Spending Accounts
• Fertility & Family Forming Benefits
• On-demand mental health support and Employee Assistance Program
• Global Travel Medical Insurance
• Short and Long Term Disability Insurance
• Life & Accident Insurance
• 401(k) Retirement Savings Plan
• Employee Stock Participation Plan
• Flexible paid time off covering vacation and sick leave
• Leave programs, including parental, pregnancy health, medical, and bereavement leave