Network Security Engineer

Network Security Engineer

The Cyber Security Engineer - Network (WAF & DDoS) is responsible for the design, implementation, operation and continual improvement of Web Application Firewall and Distributed Denial-of-Service protection capabilities across internet-facing services, applications and APIs.
The role will engineer resilient edge-security controls that protect confidentiality, integrity and availability of critical payment and digital services. This includes establishing secure WAF policies, DDoS detection and mitigation patterns, bot and API protections, traffic visibility, alerting and operational response processes across on-premises, cloud and hybrid environments.
The engineer will work closely with Network, Cloud, Application, Architecture and Security Operations teams to onboard services, tune controls, troubleshoot complex traffic flows, respond to incidents and deliver security improvements without creating unacceptable customer or service impacts.
The role is suited to an experienced network security engineer who combines strong technical capability with disciplined change management, testing, documentation and risk management within a regulated and highly available environment.

Responsibilities:
Strategy and Architecture

• Develop and maintain the target-state architecture for WAF, DDoS and edge-security capabilities across on-premises, cloud and hybrid environments.
• Define secure and reusable architecture patterns for reverse proxies, Content Delivery Networks, cloud and on-premises WAF platforms, DNS security, bot management, API protection, rate limiting and DDoS mitigation.
• Establish security engineering principles, design standards and control requirements for protecting internet-facing websites, client portals, applications, APIs and critical payment services.
• Assess proposed network, cloud, application and API changes for WAF, DDoS, service availability and internet-exposure implications.
• Provide practical security architecture advice that balances cyber risk, operational resilience, application performance, customer experience and business requirements.
• Contribute to security architecture reviews, threat assessments, threat modelling and technology selection for internet-facing services.
• Define strategic uplift opportunities to consolidate security controls, reduce complexity and retire unsupported, duplicated or ineffective WAF and DDoS technologies.
• Maintain alignment between WAF and DDoS capabilities, cyber security strategy, enterprise architecture and regulatory obligations.

Engineering and Implementation

• Design, configure, deploy and support WAF and DDoS protection services for internet-facing websites, client portals, APIs and critical business services.
• Onboard applications and APIs to WAF and DDoS services through service discovery, traffic-flow mapping, DNS and certificate coordination, policy design, security testing, production cutover and post-implementation support.
• Create and implement WAF security policies using managed rule sets, custom signatures, positive-security controls, virtual patching, geographic and IP restrictions, HTTP method controls, file-type restrictions, API schema validation and rate limiting.
• Engineer controls to protect against volumetric, protocol-based and application-layer denial-of-service attacks.
• Design and implement traffic diversion, clean-pipe and scrubbing-service arrangements for responding to DDoS attacks.
• Implement bot-management, reputation-based, behavioural and automated traffic controls to protect web applications and APIs from malicious or abusive activity.
• Configure TLS certificates, certificate chains, cipher suites, protocol versions, trusted proxy headers, source IP preservation and secure connectivity between edge platforms and backend services.
• Establish and maintain secure configuration baselines for WAF, DDoS, CDN and related edge-security platforms.
• Perform WAF rule testing, configuration validation and security-control verification using approved testing techniques and tools.
• Maintain evidence demonstrating that new and changed controls have been tested and are operating effectively before production deployment.

Security Operations and Incident Response

• Monitor WAF, CDN and DDoS telemetry to identify attacks, abnormal traffic patterns, false positives, control gaps, platform capacity concerns and emerging threats.
• Establish application and network traffic baselines, detection thresholds and automated mitigation controls for abnormal or malicious activity.
• Integrate WAF and DDoS logs, alerts and platform-health telemetry with Microsoft Sentinel or the relevant SIEM, Security Operations Centre workflows, service monitoring, incident-management processes, dashboards and operational reporting.
• Provide technical leadership during web, API and DDoS incidents, including triage, traffic analysis, containment, emergency policy changes, vendor escalation, evidence collection and service recovery.
• Support incident-command and crisis-management activities where an attack affects or threatens the availability of critical payment or digital services.
• Analyse packet captures, HTTP transactions, network-flow data, application logs and platform telemetry to diagnose complex security, performance and availability issues.
• Coordinate with telecommunications carriers, managed service providers and security vendors during active attacks and complex technical incidents.
• Participate in post-incident reviews and translate lessons learned into improvements to security controls, monitoring, response procedures and service resilience.

Policy Management and Control Optimisation

• Maintain and continually tune WAF and DDoS policies to address emerging threats, application changes, platform updates and evolving business requirements.
• Work with application and API delivery teams to understand legitimate transactions, expected application behaviour, technical dependencies and normal traffic patterns.
• Reduce false positives without weakening protection against web, API, bot and denial-of-service threats.
• Ensure security-control changes do not introduce unacceptable customer impacts, application failures, service disruption or performance degradation.
• Implement virtual patches and compensating controls to reduce exposure while underlying application vulnerabilities are being remediated.
• Review security exceptions to confirm they remain necessary, appropriately approved, time-bound and supported by effective compensating controls.
• Use attack trends, penetration-test findings, vulnerabilities, incidents and operational data to prioritise control improvements.
• Identify opportunities to improve detection coverage, mitigation speed, security effectiveness, service availability and operational efficiency.

Platform Operations and Service Resilience

• Maintain the availability, performance, health and supportability of WAF, DDoS, CDN and associated edge-security services.
• Support software and firmware currency, vulnerability remediation, platform upgrades, end-of-life and end-of-support uplift and technology refresh activities.
• Maintain documented capacity assumptions, service dependencies, high-availability arrangements, failover procedures and recovery processes for WAF and DDoS services.
• Monitor service capacity and performance to ensure security platforms can support expected transaction volumes, traffic growth and attack conditions.
• Conduct or support failover testing, recovery exercises, DDoS simulations and operational-readiness assessments.
• Maintain operational runbooks, support procedures, escalation paths and recovery documentation.
• Coordinate planned maintenance and production changes with Network, Cloud, Application, Service Operations and business stakeholders.
• Ensure operational issues, platform defects, service degradation and control failures are recorded, prioritised and remediated.

Automation and Continuous Improvement

• Automate repeatable activities including policy deployment, configuration validation, platform health checks, evidence collection, application onboarding and security reporting.
• Use scripting, platform APIs and infrastructure-as-code to improve the consistency, traceability, scalability and operational efficiency of WAF and DDoS services.
• Develop automated checks to identify configuration drift, expired certificates, disabled controls, incomplete logging and deviations from approved security baselines.
• Improve integration between WAF and DDoS platforms, SIEM, monitoring tools, ticketing systems and incident-response workflows.
• Identify opportunities to reduce manual administration, accelerate service onboarding and improve the quality of operational and assurance evidence.
• Develop meaningful security and operational metrics covering attack activity, blocked traffic, false positives, service availability, control effectiveness and remediation progress.
• Evaluate relevant platform capabilities, threat intelligence and industry developments to support the continual improvement of edge-security controls.

Stakeholder and Vendor Management

• Build effective working relationships across Cyber Engineering, Security Operations, Network, Cloud, Infrastructure, Architecture, Application, API and Service Operations teams.
• Collaborate with business and technical stakeholders to plan WAF and DDoS onboarding, control changes, service testing and production implementation.
• Contribute technical expertise to projects, architecture forums, governance reviews, incident-management activities and resilience exercises.
• Promote shared accountability for protecting internet-facing services and maintaining the availability of critical payment and digital capabilities.
• Support compliance with security policies, access management standards and relevant regulatory obligations.
• Ensure identity migration activities are documented, reviewed and approved through the appropriate architecture, change and governance processes.
• Contribute to the management and remediation of identity-related risks, including risks associated with legacy identity platforms, weak authentication, manual lifecycle processes and inconsistent access controls.
• Ensure authentication, authorisation, privileged access and client lifecycle processes are implemented in a controlled, auditable and supportable manner.

Experience required:
Essential:

• 5+ years’ experience in network security engineering, WAF, DDoS protection, application delivery or cloud security.
• Strong hands-on experience implementing and operating enterprise WAF platforms, including application onboarding, policy creation, rule tuning, false-positive management, troubleshooting and lifecycle management.
• Practical experience detecting and mitigating network, transport, protocol and application-layer DDoS attacks.
• Strong knowledge of TCP/IP, HTTP/S, TLS, DNS, routing, NAT, load balancing, reverse proxies, CDNs and internet traffic flows.
• Experience securing web applications and APIs against OWASP risks, bots, credential attacks, malicious requests and traffic floods.
• Experience with managed and custom WAF rules, positive-security models, virtual patching, rate limiting, IP reputation, geographic controls, bot mitigation and API protection.
• Strong traffic-analysis capability across packet captures, HTTP transactions, network flows, WAF events, DDoS telemetry, DNS, application logs and SIEM events.
• Ability to troubleshoot complex security, availability, routing, certificate and application-connectivity issues.
• Experience integrating network security platforms with SIEM, monitoring, ticketing, incident-response and operational reporting systems.
• Experience managing TLS certificates, keys, cipher suites, protocol versions and secure origin connectivity.
• Ability to translate application behaviour and security requirements into effective WAF and DDoS controls while balancing availability, performance and customer impact.
• Experience using scripting, APIs and infrastructure-as-code to automate configuration, validation and reporting.
• Ability to produce clear technical designs, implementation plans, test evidence, configuration records, runbooks and operational procedures.
• Strong cross-functional delivery, incident-response and stakeholder communication skills across Cyber, Network, Cloud, Infrastructure, Application, Architecture and Service Operations teams.

Desirable:

• Experience with enterprise WAF and DDoS platforms such as F5 BIG-IP Advanced WAF/ASM, F5 Distributed Cloud, Akamai, Cloudflare, Imperva, Azure WAF/DDoS Protection, AWS WAF/Shield or equivalent.
• Experience with carrier or cloud-based DDoS services, including BGP diversion, traffic scrubbing, clean-pipe services and always-on or on-demand mitigation.
• Experience with modern application-delivery technologies, including Kubernetes ingress, API gateways, service mesh, cloud load balancers and containerized applications.
• Experience with bot management, client-side protection, fraud signals, API discovery and schema enforcement.
• Experience using PowerShell, Python, REST APIs, Terraform, Bicep, GitHub Actions, Azure DevOps or equivalent automation tooling.
• Experience across Azure, AWS and hybrid cloud environments.
• Experience in payments, banking, financial services or another regulated, high-availability industry.
• Knowledge of APRA CPS 230 and CPS 234, PCI DSS, ISO/IEC 27001, NIST Cybersecurity Framework and ASD Essential Eight.

Technical Skills:

• WAF and DDoS engineering: Architecture, deployment, administration, policy tuning an