Senior WAF Engineer, Autonomous Defense

Horizon3

18h•$175,000 - $230,000•Remote

About The Position

Horizon3 is hiring a Senior Web Application Firewall Engineer to provide blue-team domain expertise within its Firewall team. The role sits between Product and Engineering and defines the domain truth used to shape product requirements, guide implementation, and inform AI agent behavior. It is not a coding or product management role; the engineer applies practical knowledge of how WAF tools behave in production to define and validate effective detection and remediation.

Requirements

At least 5 years of experience in application security, security engineering, security operations, incident response, or threat hunting.
At least 2 years of hands-on experience administering and tuning WAF platforms in production.
Hands-on production administration and tuning experience with WAF platforms such as AWS WAF, Cloudflare WAF, F5 Advanced WAF, Imperva, Akamai App & API Protector, FortiWeb, or ModSecurity with OWASP CRS; experience includes custom rules, managed rule groups, rate-based rules, exclusions, and count-to-block rollout.
Deep understanding of how AppSec and SOC teams use WAF rule outcomes and request logs for triage, containment, and investigation.
Fluency in false-positive and false-negative tradeoffs, overly permissive rules and exclusions, application-availability risks, and assessing WAF policy effectiveness and coverage.
Strong working knowledge of the OWASP Top 10, MITRE ATT&CK (including T1190), and application-control coverage frameworks, including their limitations.
Solid understanding of web attack behavior in HTTP requests and WAF telemetry, and of how WAF controls can limit exploitation of public-facing applications, injection attacks, credential stuffing, bot abuse, and API abuse.
Demonstrated experience shaping a product or platform as a domain expert, such as at a security vendor, internal tooling team, or detection engineering function.
Ability to influence without authority and move work forward without managing engineers or owning the roadmap.
Exceptional technical writing, including the ability to produce requirements, methodology documents, labeling guides, and tuning content.
Ability to translate between engineers, AI researchers, product managers, SOC analysts, and executives.
Scripting ability, ideally in Python, to query APIs, inspect telemetry, and prototype analyses.
Comfort with SQL and reasoning over large volumes of event and telemetry data.

Responsibilities

Partner with Product to translate WAF effectiveness and tuning goals into concrete, buildable requirements.
Translate blue-team workflows and challenges into prioritized product outcomes, and assess whether proposed features or agent behavior would work in a real SOC.
Define acceptance criteria for detection, effectiveness, and tuning features, and validate releases against those criteria before customer release.
Serve as a domain reference for Engineering and AI research, including design reviews and questions about attack techniques and vendor behavior.
Maintain current expertise in major WAF platforms, including their management consoles, rule and policy configuration, request logging, and APIs.
Define vendor-specific rule semantics so recommendations have equivalent intent across platforms with different policy models.
Track vendor platform releases, rule and API changes, managed rule sets, bot and API protection capabilities, and guidance; keep supported coverage current.
Define standards for correct WAF tuning recommendations, including blocking validated exploits and realistic payload variants while preserving legitimate application traffic.
Evaluate remediation output against WAF tuning standards.
Partner with the Attack team to keep exploit validation, WAF coverage, and remediation guidance grounded in current adversary tradecraft and real application behavior.
Use scripting, ideally Python, to query APIs, inspect telemetry, and prototype analyses; work with SQL and large volumes of event and telemetry data.
Create written artifacts such as requirements, methodology documents, labeling guides, and tuning content.