Security Research Analyst, WAF Managed Rules

About Us
At Cloudflare, we are on a mission to help build a better Internet. Today the company runs one of the world's largest networks that powers millions of websites and other Internet properties for customers ranging from individual bloggers to SMBs to Fortune 500 companies. Cloudflare protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare all have web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine's Top Company Cultures list and ranked among the World's Most Innovative Companies by Fast Company.
At Cloudflare, we're not looking for people who wait for a polished roadmap; we're looking for the builders who see the cracks in the Internet that everyone else has simply learned to live with. We value candidates who have the instinct to spot a "normalized" problem and the AI-native curiosity to create a solution using the latest tools. Our culture is built on iteration, leveraging AI to ship faster today to make it better tomorrow, while ensuring that every improvement, no matter how small, is shared across the team to lift everyone up. If you're the type of person who values curiosity over bureaucracy, and that AI is a partner in solving tough problems to keep the Internet moving forward, you'll fit right in.
Available Locations: Austin, TX; San Francisco, CA; New York City
About the Team
Our team researches web application attacks and turns that research into protections in Cloudflare's Web Application Firewall (WAF). We build and maintain managed rules that help protect millions of Internet properties from known vulnerabilities, emerging exploits, and new attack techniques.
We work at the intersection of vulnerability research, large-scale traffic analysis, and detection engineering. Using threat intelligence and telemetry from Cloudflare's global network, we identify exploitation patterns, develop mitigations, and measure how well they work against real traffic. We partner with Engineering, Product, and customer-facing teams to improve coverage while minimizing false positives and disruption to legitimate applications.
Who You Are

• You have hands-on experience in web application security, vulnerability research, or detection engineering, including writing and improving WAF rules, exploit signatures, or comparable detection logic.
• You understand HTTP/HTTPS, how web applications and proxies process requests, and common vulnerability classes such as SQL injection, cross-site scripting, remote code execution, SSRF, and insecure deserialization.
• You can analyze a vulnerability advisory or proof of concept, reproduce the exploit in a controlled environment, and identify the request characteristics that distinguish exploitation from legitimate traffic.
• You use SQL to investigate large datasets and a language such as Python, Go, or Rust to build research tools, automate analysis, and validate detections.
• You make evidence-based tradeoffs between detection coverage, false positives, and performance. You are comfortable investigating ambiguous reports and following issues through to resolution.
• You work effectively with engineers, product partners, and customer-facing teams, and communicate technical findings clearly to both technical and non-technical audiences.
• You use AI fluently in research and coding workflows and have the judgment to know where it accelerates the work and where its outputs need independent validation.
• You are curious about how attackers exploit web applications and bypass defenses. You do not need to know our exact stack, but you should be eager to go deep in the domain.

What You'll Do
We are looking for a Security Research Analyst to research web application threats and develop the managed rules that protect Cloudflare customers. You will turn public CVEs, threat intelligence, customer reports, and internal telemetry into tested, effective mitigations.
Your work will span the detection lifecycle: understanding an exploit, designing a rule, validating it against malicious and legitimate requests, and measuring its behavior in production. You will collaborate with engineering and research partners to close coverage gaps and continuously improve the quality of our WAF protections.
Key responsibilities:

• Research vulnerabilities and exploitation. Analyze public CVEs, proof-of-concept exploits, and observed attacks to understand root causes, exploit chains, and opportunities for WAF mitigation.
• Develop and maintain managed rules. Design, test, and deploy WAF managed rules and exploit signatures, keeping protections effective as applications, exploits, and attacker techniques evolve.
• Investigate false positives and missed attacks. Analyze customer reports and request telemetry, reproduce issues, and refine detections to improve protection without unnecessarily blocking legitimate traffic.
• Validate coverage and resistance to bypasses. Use targeted penetration testing, exploit variants, and adversarial testing to identify detection gaps and evaluate proposed mitigations.
• Automate research and validation. Build tools and reproducible test cases that accelerate exploit analysis, rule validation, regression testing, and traffic analysis.
• Measure detection quality. Use SQL, dashboards, and production data to assess rule efficacy, track attack trends, and guide improvements to coverage, false-positive rates, and performance.
• Collaborate across teams. Partner with Engineering, Product, and other detection teams to deliver reliable protections and resolve recurring customer problems at their roots.
• Share actionable research. Document findings, explain mitigation decisions, and contribute to internal research reports and public-facing blogs on vulnerabilities and Internet-wide attack trends.

Additional Experience We Value

• Experience developing WAF rules or contributing to open-source WAF projects, such as ModSecurity or the OWASP Core Rule Set.
• Experience finding WAF bypasses, analyzing request parsing and encoding differences, or researching novel exploitation techniques.
• Experience with large-scale security analytics, advanced SQL, columnar databases such as ClickHouse, and visualization tools such as Grafana.
• Experience building automated exploit-reproduction environments, detection test suites, or CI pipelines for security rules.
• Familiarity with Linux/UNIX systems, TCP/IP networking, reverse proxies, and the performance constraints of inspecting production traffic.
• Published security research, conference presentations, open-source security tools, or demonstrated work through bug bounty programs or CTFs.
• Experience partnering with data science or machine learning teams to combine rule-based detections with other security signals.

Compensation
Compensation may be adjusted depending on work location.

• For San Francisco based hires: Estimated annual salary of $157,000 - $216,000
• For New York City based hires: Estimated annual salary of $150,000 - $206,000

Equity
This role is eligible to participate in Cloudflare's equity plan.
Benefits
Cloudflare offers a complete package of benefits and programs to support you and your family. Our benefits programs can help you pay health care expenses, support caregiving, build capital for the future and make life a little easier and fun! The below is a description of our benefits for employees in the United States, and benefits may vary for employees based outside the U.S.
Health & Welfare Benefits

• Medical/Rx Insurance
• Dental Insurance
• Vision Insurance
• Flexible Spending Accounts
• Commuter Spending Accounts
• Fertility & Family Forming Benefits
• On-demand mental health support and Employee Assistance Program
• Global Travel Medical Insurance

Financial Benefits

• Short and Long Term Disability Insurance
• Life & Accident Insurance
• 401(k) Retirement Savings Plan
• Employee Stock Participation Plan

Time Off

• Flexible paid time off covering vacation and sick leave
• Leave programs, including parental, pregnancy health, medical, and bereavement leave

What Makes Cloudflare Special?
We're not just a highly ambitious, large-scale technology company. We're a highly ambitious, large-scale technology company with a soul. Fundamental to our mission to help build a better Internet is protecting the free and open Internet.
Project Galileo: Since 2014, we've equipped more than 2,400 journalism and civil society organizations in 111 countries with powerful tools to defend themselves against attacks that would otherwise censor their work, technology already used by Cloudflare's enterprise customers--at no cost.
Athenian Project: In 2017, we created the Athenian Project to ensure that state and local governments have the highest level of protection and reliability for free, so that their constituents have access to election information and voter registration. Since the project, we've provided services to more than 425 local government election websites in 33 states.
1.1.1.1: We released 1.1.1.1 to help fix the foundation of the Internet by building a faster, more secure and privacy-centric public DNS resolver. This is available publicly for everyone to use - it is the first consumer-focused service Cloudflare has ever released. Here's the deal - we don't store client IP addresses never, ever. We will continue to abide by our privacy commitment and ensure that no user data is sold to advertisers or used to target consumers.
Sound like something you'd like to be a part of? We'd love to hear from you!
Please note that applicants who progress to the offer stage of the interview process may be asked to attend an in-person interview within one of the Cloudflare Offices or Cloudflare Hubs. More details about this will be available at that stage of the interview process.
This position may require access to information protected under U.S. export control laws, including the U.S. Export Administration Regulations. Please note that any offer of employment may be conditioned on your authorization to receive software or technology controlled under these U.S. export laws without sponsorship for an export license.
Cloudflare is proud to be an equal opportunity employer. We are committed to providing equal employment opportunity for all people and place great value in both diversity and inclusiveness. All qualified applicants will be considered for employment without regard to their, or any other person's, perceived or actual race, color, religion, sex, gender, gender identity, gender expression, sexual orientation, national origin, ancestry, citizenship, age, physical or mental disability, medical condition, family care status, or any other basis protected by law. We are an AA/Veterans/Disabled Employer.
Cloudflare provides reasonable accommodations to qualified individuals with disabilities. Please tell us if you require a reasonable accommodation to apply for a job. Examples of reasonable accommodations include, but are not limited to, changing the application process, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment. If you require a reasonable accommodation to apply for a job, please contact us via e-mail at [email protected] or via mail at 101 Townsend St. San Francisco, CA 94107.