F5 Advanced Web Application Firewall Engineer

Core4ce

5d • $125,000 - $145,000

About The Position

Core4ce is seeking an experienced F5 Advanced Web Application Firewall (AWAF) Engineer to support the secure operation of enterprise web applications and APIs. The engineer will work closely with the cybersecurity team to define WAF policy baselines for individual systems and applications, collaborating with system owners, application teams, and infrastructure personnel to validate expected application behavior, tune policies, reduce false positives, and maintain effective security enforcement.

The role supports application-security alert response by analyzing WAF events, identifying potentially malicious activity, coordinating with stakeholders, and assisting with investigation, documentation, and mitigation. Responsibilities are designed to be flexible and may evolve to meet business needs and enable individual growth.

Requirements

• U.S. citizen.
• Ability to obtain and maintain an active Secret security clearance.
• Bachelor’s degree in cybersecurity, computer science, information technology, or a related technical field, or equivalent practical experience.
• At least 5 years of experience in cybersecurity, network security, application security, or a related field.
• At least 3 years of hands-on experience with F5 Advanced WAF, F5 ASM, or a comparable enterprise WAF platform.
• Demonstrated experience developing, deploying, administering, and tuning F5 WAF policies.
• Experience establishing application-specific WAF policy baselines and enforcement requirements.
• Experience working directly with application owners, developers, and infrastructure teams to analyze application behavior and resolve false positives.
• Experience analyzing WAF logs, violations, security events, and blocked traffic.
• Working knowledge of web application and API security, including HTTP and HTTPS, TLS, HTTP methods, headers, cookies, sessions, URLs, parameters, payloads, JSON, XML, REST APIs, authentication, and authorization.
• Strong knowledge of common web application vulnerabilities and attack techniques, including the OWASP Top 10.
• Experience assisting with cybersecurity alert triage, incident investigation, or incident-response activities.
• Ability to document technical findings, policy decisions, exceptions, and recommended actions.
• Excellent written and verbal communication skills.

Nice To Haves

• F5 Certified Technology Specialist certification or equivalent F5 AWAF/ASM experience.
• Experience with F5 BIG-IP administration and related technologies, including LTM, APM, iRules, Local Traffic Policies, and SSL profiles.
• Experience protecting APIs, microservices, cloud-hosted applications, and distributed application architectures.
• Experience with F5 WAF policy automation, REST APIs, configuration management, or infrastructure-as-code.
• Experience integrating F5 WAF with SIEM, SOAR, ticketing, or security orchestration platforms.
• Familiarity with F5 WAF event logging, reporting, and analytics capabilities.
• Experience using Splunk, Microsoft Sentinel, or comparable security-monitoring platforms.
• Familiarity with vulnerability scanners and application-security testing tools.
• Experience supporting penetration tests and validating application-security remediation.
• Knowledge of secure software development practices and common application deployment methods.
• Familiarity with NIST, DoD, FedRAMP, FISMA, or other applicable cybersecurity frameworks and controls.
• Experience working in a federal, DoD, healthcare, or other regulated environment.
• Security+ CE or another applicable DoD 8570/8140 baseline certification.

Responsibilities

• Design, configure, implement, and maintain F5 Advanced WAF/ASM policies for enterprise web applications and APIs.
• Develop application-specific WAF policy baselines based on application architecture, functionality, data sensitivity, business risk, and security requirements.
• Work with the cybersecurity team to establish repeatable WAF standards, policy-development procedures, and enforcement criteria.
• Onboard new applications and services into the F5 WAF environment.
• Configure and maintain protections against OWASP Top 10 threats, signature-based attacks, protocol violations, malicious files and payloads, evasion techniques, parameter and URL violations, cookie and session-related attacks, and API and JSON/XML threats where applicable.
• Review learning suggestions, traffic behavior, violations, and policy recommendations.
• Move policies through staging, transparent, and blocking or enforcement modes.
• Create, test, document, and maintain appropriate policy exceptions and trusted traffic controls.
• Apply policy changes in accordance with change-management and cybersecurity procedures.
• Partner with system owners, application developers, and infrastructure teams to understand legitimate application behavior.
• Tune WAF policies to protect applications while maintaining availability and operational performance.
• Investigate false positives and determine whether blocked or flagged requests indicate legitimate business activity, application defects, or malicious behavior.
• Recommend corrective actions for application issues identified through WAF policy analysis.
• Review policy effectiveness and improve policies based on application changes, threat intelligence, vulnerability assessments, and observed attack patterns.
• Document application-specific requirements, policy decisions, exceptions, and tuning activities.
• Monitor and analyze WAF violations, security events, blocked requests, and anomalous traffic.
• Assist the cybersecurity team with alert triage and response activities.
• Investigate suspected attacks, including SQL injection, cross-site scripting, command injection, path traversal, protocol abuse, automated attacks, and other web-based threats.
• Correlate WAF events with application, network, endpoint, and security-monitoring data when necessary.
• Validate suspicious activity with system owners and other technical stakeholders.
• Escalate significant or confirmed events in accordance with incident-response procedures.
• Support containment, mitigation, and follow-up actions, including temporary policy changes or blocking controls when appropriate.
• Prepare incident summaries, technical findings, and remediation recommendations.
• Identify recurring attack patterns and recommend improvements to WAF policies and broader security controls.

Benefits

• 401(k) with a 100% company match on the first 6% deferred, with immediate vesting.
• Comprehensive medical, dental, and vision coverage, with the employee portion paid 100% by Core4ce.
• Unlimited access to training and certifications, with no preset cap on eligible professional development.
• Tuition assistance for job-related degrees and courses.
• Paid parental leave.
• PTO that grows with tenure.
• Generous holiday schedules.
• The Forge gives employees the opportunity to propose innovations and receive internal backing.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior