Security Research Analyst, WAF Managed Rules

Cloudflare•San Francisco, CA

11d

About The Position

Cloudflare is hiring a Security Research Analyst to research web application threats and develop managed rules that protect its customers. The role is part of a team that studies web application attacks and turns research into WAF protections, working at the intersection of vulnerability research, large-scale traffic analysis, and detection engineering. The analyst will use threat intelligence and telemetry from Cloudflare’s global network to identify exploitation patterns, develop mitigations, and measure their effectiveness against real traffic. The position covers the detection lifecycle: analyzing vulnerabilities and exploits, designing and testing rules, validating them against malicious and legitimate requests, and measuring their behavior in production. The analyst will work with Engineering, Product, research, and customer-facing teams to close protection gaps, address customer problems, and improve detection quality while balancing coverage, false positives, and performance. The role also includes documenting findings and contributing to internal research reports and public-facing writing about vulnerabilities and attack trends. Available locations are Austin, Texas; San Francisco, California; and New York City. The position may require access to information controlled under U.S. export laws, and an offer may depend on authorization to receive such technology without export-license sponsorship.

Requirements

Hands-on experience in web application security, vulnerability research, or detection engineering, including writing and improving WAF rules, exploit signatures, or comparable detection logic.
Understanding of HTTP/HTTPS, web application and proxy request processing, and common vulnerability classes such as SQL injection, cross-site scripting, remote code execution, SSRF, and insecure deserialization.
Ability to analyze vulnerability advisories or proof-of-concept exploits, reproduce exploits in a controlled environment, and identify request characteristics that distinguish exploitation from legitimate traffic.
Ability to use SQL to investigate large datasets and a language such as Python, Go, or Rust to build research tools, automate analysis, and validate detections.
Ability to make evidence-based tradeoffs among detection coverage, false positives, and performance.
Comfort investigating ambiguous reports and following issues through to resolution.
Ability to work effectively with engineering, product, and customer-facing teams and communicate technical findings clearly to technical and non-technical audiences.
Fluent use of AI in research and coding workflows, with judgment to independently validate AI outputs.
Curiosity about web application exploitation and bypassing defenses, and eagerness to develop deep domain expertise.

Nice To Haves

Experience developing WAF rules or contributing to open-source WAF projects such as ModSecurity or the OWASP Core Rule Set.
Experience finding WAF bypasses, analyzing request parsing and encoding differences, or researching novel exploitation techniques.
Experience with large-scale security analytics, advanced SQL, columnar databases such as ClickHouse, and visualization tools such as Grafana.
Experience building automated exploit-reproduction environments, detection test suites, or CI pipelines for security rules.
Familiarity with Linux/UNIX systems, TCP/IP networking, reverse proxies, and the performance constraints of inspecting production traffic.
Published security research, conference presentations, open-source security tools, or demonstrated work through bug bounty programs or CTFs.
Experience partnering with data science or machine learning teams to combine rule-based detections with other security signals.

Responsibilities

Research public CVEs, proof-of-concept exploits, and observed attacks to understand root causes, exploit chains, and WAF mitigation opportunities.
Design, test, deploy, and maintain WAF managed rules and exploit signatures as applications and attacker techniques evolve.
Investigate customer reports, false positives, and missed attacks by analyzing request telemetry, reproducing issues, and refining detections.
Use targeted penetration testing, exploit variants, and adversarial testing to identify detection gaps and evaluate mitigations.
Build tools and reproducible test cases for exploit analysis, rule validation, regression testing, and traffic analysis.
Use SQL, dashboards, and production data to assess rule efficacy and attack trends, and guide improvements to coverage, false-positive rates, and performance.
Partner with Engineering, Product, and other detection teams to deliver reliable protections and address recurring customer problems at their roots.
Document findings and mitigation decisions, contribute to internal research reports, and share research through public-facing blogs on vulnerabilities and Internet-wide attack trends.

Benefits

Equity plan participation.
Medical/Rx insurance.
Dental insurance.
Vision insurance.
Flexible spending accounts.
Commuter spending accounts.
Fertility and family-forming benefits.
On-demand mental health support and Employee Assistance Program.
Global travel medical insurance.
Short- and long-term disability insurance.
Life and accident insurance.
401(k) retirement savings plan.
Employee Stock Participation Plan.
Flexible paid time off covering vacation and sick leave.
Leave programs, including parental, pregnancy health, medical, and bereavement leave.