2 months ago
Hyderābād, IndiaSenior
Responsibilities
- Design, implement, and manage WAF policies for web applications and APIs across development, staging, and production environments.
- Configure and tune managed and custom rules to mitigate OWASP Top 10 threats, including SQL injection, XSS, CSRF, RCE, LFI/RFI, and SSRF.
- Reduce false positives through traffic baselining, exception handling, and staged monitor, challenge, and block enforcement.
- Implement rate limiting, IP reputation, geographic and ASN controls, and bot mitigation strategies.
- Integrate WAF logs with SIEM and log platforms and build threat-monitoring dashboards and alerts.
- Support incident response for active attacks, including Layer 7 DDoS and exploit attempts, and perform post-incident improvements.
- Automate WAF deployments and configuration management using infrastructure-as-code tools and CI/CD pipelines.
- Conduct security reviews, reporting, and metrics tracking for blocked events, attacks, false-positive rates, and MTTR.
- Collaborate with application teams on secure headers, TLS, authentication flows, and compatibility testing.
- Use PowerShell or Python to integrate with Imperva APIs and improve scalable WAF operations.
Requirements
- At least 7 years of experience in WAF engineering and implementation.
- At least 3 years of hands-on experience with Imperva or Cloudflare is preferred.
- Hands-on experience with at least one WAF platform, including Imperva, Akamai, ModSecurity, AWS WAF, Azure WAF, Cloudflare, or F5 ASM/Advanced WAF.
- Strong understanding of HTTP/HTTPS, web application architecture, REST APIs, and common attack patterns.
- Experience tuning WAF rules and balancing security requirements against false positives.
- Experience with logging, monitoring, and SIEM integrations.
- Scripting and automation skills with PowerShell, Python, or Bash, plus regex and JSON/YAML.
- Familiarity with CI/CD and infrastructure-as-code principles.
- Experience with bot management, advanced detection techniques, API gateways, API security controls, cloud networking, CDNs, or reverse proxies is preferred.
- Security certifications such as AWS Security Specialty, Azure Security Engineer, CCSP, CEH, or Security+ are preferred.
Benefits
- Hybrid work flexibility in Zelis India.
- Comprehensive healthcare benefits, financial wellness programs, and cultural celebrations.
- Collaborative work culture, leadership development, and global exposure.
Categories
About Zelis
Zelis builds a connected healthcare payments and pricing platform for U.S. payers, providers, and consumers, offering payment integrity, claims pricing/bill review, electronic payments, and network optimization. It sells software and managed services to health plans, TPAs, and self-insured employers to reduce claims errors and streamline reimbursement. Privately held and headquartered in Boston, it serves over 750 payers, including the top five national health plans, and millions of healthcare professionals and consumers.