Job Description
The WAF and Bot Management Specialist will be a key member of our cybersecurity operations team, responsible for the design, implementation, management, and optimization of our Web Application Firewall (WAF) solutions. This role requires deep technical expertise in WAF technologies, strong analytical skills for threat detection and response, and a proactive approach to enhancing our security posture. The successful candidate will play a critical role in safeguarding our web applications against a wide range of cyberattacks.
Key Responsibilities:
WAF Management & Optimization:
Design, deploy, configure, and maintain WAF policies and rulesets to protect web applications from common vulnerabilities and emerging threats.
Perform regular reviews and fine-tuning of WAF configurations to minimize false positives while ensuring comprehensive protection.
Collaborate with application development to integrate WAF security controls into the application lifecycle.
Threat Detection & Incident Response:
Lead the strategy, implementation, and fine-tuning of anti-bot solutions to combat sophisticated automated threats, including scraping, ATO, DDoS etc.
Monitor WAF logs and alerts for suspicious activities, security incidents, and potential breaches.
Conduct in-depth analysis of WAF logs, network traffic, and application behavior to identify attack patterns, compromise indicators, and sophisticated threats.
Lead incident response activities related to web application attacks, including investigation, containment, eradication, recovery, and post-mortem analysis.
Develop and implement custom detection rules and signatures based on threat intelligence and observed attack techniques.
Log Analysis & Pattern Detection:
Utilize SIEM platforms and other security tools to perform advanced log analysis, correlation, and anomaly detection.
Develop and refine analytical techniques to identify subtle attack patterns and indicators of compromise that may evade standard defenses.
Generate actionable intelligence from security logs to improve WAF efficacy and overall security posture.
Vulnerability Management & Remediation:
Reporting & Documentation:
Prepare and present regular reports on WAF performance, security incidents, and threat landscape trends.
Maintain comprehensive documentation of WAF configurations, policies, procedures, and incident response playbooks.
Mentorship & Collaboration:
Provide technical guidance and mentorship to junior analysts within the team.
Collaborate effectively with cross-functional teams, including IT operations, development, and compliance.
Qualifications:
Bachelors degree in Computer Science, Cybersecurity, Information Technology, or a related field.
Minimum of 2+ years of experience in a dedicated WAF management or web application security role.
Proven expertise in designing, implementing, and managing WAF solutions.
Strong understanding of web application vulnerabilities (OWASP Top 10, CWE), attack vectors, and mitigation strategies.
Excellent analytical, problem-solving, and critical thinking skills.
Strong communication skills, both written and verbal, with the ability to articulate complex technical concepts to diverse audiences.
Ability to work independently and as part of a collaborative team in a fast-paced environment.
Nice to Have:
Hands-on experience with Cloudflare WAF, DDoS protection, and related security services.
Relevant industry certifications (e.g., CISSP, GWAPT, GWEB, CEH).
Experience with cloud security platforms (AWS, Azure, GCP) and containerized environments.
Experience in e-commerce environments
Demonstrable experience with log analysis, SIEM platforms (e.g., Splunk, Elastic Stack, Microsoft Sentinel), and advanced pattern detection techniques.
Proficiency in scripting languages (e.g.,SQL, Python, PowerShell) for automation and data analysis is a plus.
We are all different - one talent to another - that is how we rely on our differences. At AirAsia, you will be treated fairly and given all chances to be your best.We are committed to creating a diverse work environment and are proud to be an equal opportunity employer.
Search Firm Representatives - AirAsia does not accept unsolicited assistance from search firms for employment opportunities. All CVs / resumes submitted by search firms to any employee at our company without a valid written search agreement in place will be deemed the sole property of our company. No fee will be paid in the event a candidate is hired by our company as a result of an agency referral where no pre-existing agreement is in place.