<p>The <b>Senior Cybersecurity Web Application Firewall (WAF) Specialist</b> is the leading expert and strategic owner of WAF and application-edge security within the organization. This key role defines the vision, strategy, and standards that ensure protection for all public-facing applications across Cox Automotive.</p><p>As the go-to Engineer, you will drive the architecture of WAF implementations, lead complex threat response efforts, enhance automation and logging capabilities, and work closely with cross-functional engineering, cybersecurity, and business teams to ensure resilient, scalable, and modern WAF protections. Your main responsibilities include tuning and enhancing security policies, implementing WAF for new public websites based on defined architectural patterns, and participating in security events to leverage the WAF as a defensive measure against cyber threats.</p><p>This position leverages your technical expertise in implementing and managing web application firewalls as effective cybersecurity controls. You will apply your experience in networking concepts such as DNS, HTTP/S, and edge services to route website traffic, while also understanding how web and mobile applications utilize client-server communication. Collaboration with cross-functional teams throughout the organization is essential.</p><p>This role directly reports to the Senior Manager of Application Security at Cox Automotive.</p><p><b>What You'll Do:</b></p><ul><li>Champion the enterprise WAF, shaping its strategy, standards, and architectural patterns in collaboration with the architecture team, enhancing security for all public-facing sites and APIs.</li><li>Analyze WAF rules to identify enhancements and articulate necessary changes to improve security protections.</li><li>Partner with security architecture on long-term WAF strategies, including technology standards and security roadmaps.</li><li>Create and update runbooks, playbooks, and threat-specific WAF tuning strategies, while driving continuous improvement of detection and triggers.</li><li>Conduct trend analysis and reporting in cyber engineering, recommending improvements in tools and infrastructure.</li><li>Assist in reviewing plans and policies to foster an improved overall security environment.</li><li>Engage in security events and incident response to identify design gaps and propose preventive solutions for recurring threats.</li><li>Stay abreast of emerging security trends, threats, and technologies, suggesting suitable enhancements.</li><li>Collaborate closely with AppSec, Cyber Defense, and Engineering teams to foster a secure-by-default approach.</li></ul><p><b>Who Are You:</b></p><p><b>Minimum Qualifications</b></p><ul><li>Bachelor's degree in a related field with 6 years of experience, or alternatively a master's degree with 4 years of experience; a Ph.D. and 1 year of experience; or 18 years of relevant experience without a degree.</li><li>A minimum of 4 years of cybersecurity experience, including at least 2 years managing enterprise WAF.</li><li>Demonstrated expertise in architecting, implementing, and operating enterprise WAF solutions across diverse environments.</li><li>In-depth knowledge of network traffic routing between clients and servers on the internet (e.g., DNS, HTTP/S, CDN/edge routing).</li><li>Able to explain specific cybersecurity policies and procedures clearly to both technical and non-technical audiences.</li><li>Proven experience leading technical projects and mentoring engineering teams.</li><li>Excellent customer service, writing, and presentation skills.</li><li>Capable of fostering a collaborative work environment and aligning cybersecurity best practices with key stakeholders.</li><li>Consultative approach to navigating complex topics with various levels of the organization.</li><li>Proficient in Python and Terraform.</li><li>Skilled in creatively addressing complex cybersecurity challenges while demonstrating solid business acumen.</li><li>Experience with Agile methodologies and DevSecOps practices.</li><li>Track record of initiating change and deploying solutions in Fortune 1000 organizations.</li><li>Familiarity with cybersecurity frameworks (e.g., ISO 27000, NIST, FFIEC) and applicable regulations (e.g., GDPR, FFIEC, GLBA).</li></ul><p><b>Preferred Qualifications</b></p><ul><li>Knowledge of current cybersecurity architectures such as zero trust, IaaS, PaaS, SaaS, virtualization, and containerization.</li><li>Strong understanding of cloud environments, particularly with containers and serverless platforms (e.g., EKS, ECS, Lambda, Fargate).</li><li>Experience using security testing tools like Fortify, BurpSuite, and Wiz.</li><li>Extensive knowledge in technologies like .NET framework, Mono, Spring frameworks, and various cloud service authentication methods.</li><li>Familiarity with cloud infrastructure (AWS, GCP, or Azure) and services, as well as on-premises solutions.</li><li>Experience designing cybersecurity best practices for all layers of application hosting in both cloud and on-premises environments.</li><li>Understanding of Identity and Access Management (IAM), cryptography/key management, and security protocols (e.g., multi-factor, SAML, OAuth, OIDC).</li><li>Expertise with firewall technologies, web application firewalls, and edge services, along with a deep understanding of DMZ and network architectures.</li><li>Familiarity with the AWS Well-Architected Framework.</li><li>Experience in industries crucial to national infrastructure such as telecommunications, financial services, defense, or government.</li><li>Background with big four consulting firms or Fortune 500 companies.</li><li>Relevant industry certifications (e.g., CISSP, CEH, OSCP, Azure, AWS, CISM, CISA).</li></ul><p><b>Compensation:</b><br/>Compensation includes a base salary of $122,600.00 - $204,400.00, which may vary based on factors like job location and candidate qualifications. Additional incentive compensation may be available.</p><p><b>Benefits:</b><br/>The company provides employees with flexible vacation policies, seven paid holidays, and up to 160 hours of paid wellness leave annually. Additional paid time off is available for bereavement, voting, jury duty, volunteering, military service, and parental leave.</p>