Security Researcher & Analyst - WAF Application Security Experts

Cloudflare is seeking a Security Researcher & Analyst to join its Application Security organization. As a WAF Application Security Expert, you will focus on researching, designing, and improving detection logic and rules to protect customer applications from web threats. The ideal candidate will have a strong understanding of web protocols, common web vulnerabilities, and exploitation techniques, as well as experience with WAF rule development, incident detection, or threat research.

Requirements

• Bachelor's or Master's degree in Computer Science, Information Security, or equivalent practical experience
• 2+ years of experience in Web Application Security, WAF rule development, incident detection, or threat research
• Deep understanding of web protocols (HTTP/HTTPS), common web vulnerabilities, and exploitation techniques (OWASP Top 10)
• Proven experience writing and optimizing WAF rules or custom detection logic
• Hands-on experience with vulnerability analysis, exploit reproduction, or reverse engineering
• Strong analytical mindset and comfort working with large data sets (SQL, ClickHouse, BigQuery, etc.)
• Proficiency in at least one programming language such as Python, Go, or Rust for building automation tools or analysis scripts
• Familiarity with Grafana or equivalent visualization tools to track rule performance and attack trends
• Strong written and verbal communication skills - able to document, present, and collaborate effectively
• Experience working in fast-paced environments with production-scale systems

Benefits

• Comprehensive health insurance
• 401(k) matching
• Retirement plan
• Generous paid time off
• Flexible work arrangements
• Professional development opportunities
• Egalitarian culture and diverse work environment