Security Research Analyst, WAF Managed Rules

Title: Security Research Analyst, WAF Managed Rules Location: Hybrid

Available Locations: Austin, TX; San Francisco, CA; New York City

About the Team

Our team researches web application attacks and turns that research into protections in Cloudflare’s Web Application Firewall (WAF). We build and maintain managed rules that help protect millions of Internet properties from known vulnerabilities, emerging exploits, and new attack techniques.

We work at the intersection of vulnerability research, large-scale traffic analysis, and detection engineering. Using threat intelligence and telemetry from Cloudflare’s global network, we identify exploitation patterns, develop mitigations, and measure how well they work against real traffic. We partner with Engineering, Product, and customer-facing teams to improve coverage while minimizing false positives and disruption to legitimate applications.

Who You Are

• You have hands-on experience in web application security, vulnerability research, or detection engineering, including writing and improving WAF rules, exploit signatures, or comparable detection logic.
• You understand HTTP/HTTPS, how web applications and proxies process requests, and common vulnerability classes such as SQL injection, cross-site scripting, remote code execution, SSRF, and insecure deserialization.
• You can analyze a vulnerability advisory or proof of concept, reproduce the exploit in a controlled environment, and identify the request characteristics that distinguish exploitation from legitimate traffic.
• You use SQL to investigate large datasets and a language such as Python, Go, or Rust to build research tools, automate analysis, and validate detections.
• You make evidence-based tradeoffs between detection coverage, false positives, and performance. You are comfortable investigating ambiguous reports and following issues through to resolution.
• You work effectively with engineers, product partners, and customer-facing teams, and communicate technical findings clearly to both technical and non-technical audiences.
• You use AI fluently in research and coding workflows and have the judgment to know where it accelerates the work and where its outputs need independent validation.
• You are curious about how attackers exploit web applications and bypass defenses. You do not need to know our exact stack, but you should be eager to go deep in the domain.

What You'll Do

We are looking for a Security Research Analyst to research web application threats and develop the managed rules that protect Cloudflare customers. You will turn public CVEs, threat intelligence, customer reports, and internal telemetry into tested, effective mitigations.

Your work will span the detection lifecycle: understanding an exploit, designing a rule, validating it against malicious and legitimate requests, and measuring its behavior in production. You will collaborate with engineering and research partners to close coverage gaps and continuously improve the quality of our WAF protections.

Key responsibilities:

• Research vulnerabilities and exploitation. Analyze public CVEs, proof-of-concept exploits, and observed attacks to understand root causes, exploit chains, and opportunities for WAF mitigation.
• Develop and maintain managed rules. Design, test, and deploy WAF managed rules and exploit signatures, keeping protections effective as applications, exploits, and attacker techniques evolve.
• Investigate false positives and missed attacks. Analyze customer reports and request telemetry, reproduce issues, and refine detections to improve protection without unnecessarily blocking legitimate traffic.
• Validate coverage and resistance to bypasses. Use targeted penetration testing, exploit variants, and adversarial testing to identify detection gaps and evaluate proposed mitigations.
• Automate research and validation. Build tools and reproducible test cases that accelerate exploit analysis, rule validation, regression testing, and traffic analysis.
• Measure detection quality. Use SQL, dashboards, and production data to assess rule efficacy, track attack trends, and guide improvements to coverage, false-positive rates, and performance.
• Collaborate across teams. Partner with Engineering, Product, and other detection teams to deliver reliable protections and resolve recurring customer problems at their roots.
• Share actionable research. Document findings, explain mitigation decisions, and contribute to internal research reports and public-facing blogs on vulnerabilities and Internet-wide attack trends.

Additional Experience We Value

• Experience developing WAF rules or contributing to open-source WAF projects, such as ModSecurity or the OWASP Core Rule Set.
• Experience finding WAF bypasses, analyzing request parsing and encoding differences, or researching novel exploitation techniques.
• Experience with large-scale security analytics, advanced SQL, columnar databases such as ClickHouse, and visualization tools such as Grafana.
• Experience building automated exploit-reproduction environments, detection test suites, or CI pipelines for security rules.
• Familiarity with Linux/UNIX systems, TCP/IP networking, reverse proxies, and the performance constraints of inspecting production traffic.
• Published security research, conference presentations, open-source security tools, or demonstrated work through bug bounty programs or CTFs.
• Experience partnering with data science or machine learning teams to combine rule-based detections with other security signals.

Compensation

Compensation may be adjusted depending on work location.

• For San Francisco based hires: Estimated annual salary of $157,000 - $216,000
• For New York City based hires: Estimated annual salary of $150,000 - $206,000

Equity

This role is eligible to participate in Cloudflare’s equity plan.

Benefits

Cloudflare offers a complete package of benefits and programs to support you and your family.  Our benefits programs can help you pay health care expenses, support caregiving, build capital for the future and make life a little easier and fun!  The below is a description of our benefits for employees in the United States, and benefits may vary for employees based outside the U.S.

Health & Welfare Benefits

• Medical/Rx Insurance
• Dental Insurance
• Vision Insurance
• Flexible Spending Accounts
• Commuter Spending Accounts
• Fertility & Family Forming Benefits
• On-demand mental health support and Employee Assistance Program
• Global Travel Medical Insurance

Financial Benefits

• Short and Long Term Disability Insurance
• Life & Accident Insurance
• 401(k) Retirement Savings Plan
• Employee Stock Participation Plan

Time Off

• Flexible paid time off covering vacation and sick leave
• Leave programs, including parental, pregnancy health, medical, and bereavement leave