Staff Web Security Engineer

Coupang•Seattle, WA

5h•$138,000 - $297,000

About The Position

The Detection Operations team protects Coupang’s global attack surface across web, network, email, and endpoint security. The team manages security technologies and works to detect, investigate, and mitigate cyber threats before they affect the business, using proactive threat detection, rapid response, and root cause analysis to improve security posture and prevent future incidents. The Staff Web Security Engineer designs, deploys, and manages security controls for externally facing web and API services. The role focuses on WAF detection and policy tuning, bot and DDoS defense, proactive threat hunting, API security, analysis of SIEM data and web access logs, and the creation of operational procedures and automation. The engineer partners with engineering, infrastructure, and security teams to investigate incidents and strengthen security capabilities.

Requirements

Bachelor’s degree in Computer Science or a related field.
At least 4 years of experience in Security Engineering or Cybersecurity.

Nice To Haves

Ability to analyze security telemetry, access logs, and detection events to determine root causes, troubleshoot complex issues, and drive remediation.
Strong communication and stakeholder management skills, including the ability to influence decisions, build alignment, and communicate risks and recommendations using data-driven insights.
Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or a related field, or equivalent practical experience.
Hands-on experience securing large-scale web environments, including DNS, DDoS mitigation, web application attacks, bot management, vulnerability response, and security event investigations.
10 or more years of experience in Web Security, Security Operations, Threat Detection, Incident Response, or a related cybersecurity discipline.
Ability to travel internationally as required and obtain and maintain necessary travel documentation.
Industry-recognized cybersecurity certifications such as CISSP, GIAC, GSEC, GCIH, GCIA, Security+, or equivalent.
Hands-on production experience with Web Security CDN, WAF, Bot Management, or DDoS protection platforms.
Experience analyzing large datasets with SQL and security analytics platforms such as SIEM solutions, AWS Athena, Splunk, Elastic, or similar technologies.
Proficiency in one or more programming or scripting languages such as Python, JavaScript, Go, or Bash.
Experience investigating and responding to web security incidents in large-scale e-commerce, technology, or internet-facing environments.
Strong understanding of web application security principles, common attack techniques, and frameworks such as OWASP Top 10 and MITRE ATT&CK.
Experience developing security automation, operational workflows, detection logic, playbooks, or response procedures.
Excellent written and verbal communication skills and ability to collaborate across engineering, infrastructure, product, and security teams.
Korean language proficiency.

Responsibilities

Design, deploy, and manage security controls for externally facing web and API services.
Analyze and tune WAF detections to reduce false positives and false negatives, improve coverage, deploy security policies, and respond to vulnerabilities and CVEs.
Detect and mitigate automated and malicious bot activity, improving detection logic, policies, and bot defense capabilities.
Strengthen DDoS detection and mitigation through monitoring, analysis, and policy optimization.
Conduct proactive web threat hunting to identify attack patterns and improve detection and preventive controls.
Develop and maintain operational procedures, documentation, and automation workflows.
Analyze API security events and improve detection, investigation, and response workflows.
Analyze SIEM data, security telemetry, and web access logs to identify trends, investigate incidents, and report actionable security insights and metrics.
Partner with engineering, infrastructure, and security teams on incident investigations, operational improvements, and cross-functional security initiatives.
Create and maintain monitoring use cases, detection logic, playbooks, and response procedures.