F5 WAF Lead Engineer

Role:F5 WAF Lead Engineer
Location: Remote

Key Responsibilities

• Define and lead the strategy for transitioning from broad WAF rules to per-application, tailored security policies across a large application portfolio.
• Design and build an AI-assisted policy development workflow using scan output, traffic data, and application configuration to recommend and generate tailored WAF policies at scale.
• Evaluate, recommend, and implement F5 Distributed Cloud (XC) WAAP policies on an application-by-application basis.
• Integrate findings from vulnerability and penetration testing tools into the policy development process.
• Partner directly with client cybersecurity leadership to define deliverables, direction, and rollout milestones.
• Establish repeatable methodology and documentation so the practice can scale as volume grows and the team expands.
• Support and mentor additional team members as the engagement scales.
• Troubleshoot complex WAF policy, traffic, and security issues across cloud-hosted environments.
• Support incident response and root cause analysis for WAF/application security events.
• Coordinate change management and production deployment windows for policy rollouts.

Required Qualifications

• 5+ years of experience in web application firewall engineering, with strong hands-on expertise in F5 Distributed Cloud (XC) WAAP.
• Demonstrated experience designing and implementing custom, per-application WAF policies (not just baseline/default rule sets).
• Experience conducting web application vulnerability assessment and remediation.
• Strong understanding of OWASP Top 10 and emerging web application threats.
• Experience leveraging AI/automation tooling to scale security operations (policy generation, evaluation, or triage).
• Ability to operate as both a strategic lead (defining direction, engaging client stakeholders) and a hands-on implementer.
• Experience with F5 Silverline and/or BIG-IP ASM/Advanced WAF (prior-generation context).
• Familiarity with cloud-hosted application architectures.
• Excellent communication skills able to present strategy and status to client security leadership.