below marketmost similar roles pay hereabove market
This role pays more than
80%
of similar roles. Most pay
$122,275–$178,787
— the blue band above.
At the midpoint, this role pays about
$186k
versus about
$151k
for comparable roles.
Based on 240 similar postings.
Employer
About Cloudflare, Inc
Cloudflare is a prominent cloud services and security company that provides content delivery network (CDN), DDoS mitigation, and Zero Trust security services to millions of internet properties.
Cloudflare, Inc currently has
113 open roles
on FindRole.
Listed pay typically runs
$194,000–$266,000
across 62 roles with salary data.
The Security Research Analyst, WAF Managed Rules joins the team responsible for researching web application attacks and developing protections within the Web Application Firewall. This role involves analyzing public CVEs, threat intelligence, and internal telemetry to identify exploitation patterns and develop mitigations. You will design, test, and deploy managed rules and exploit signatures while investigating false positives to minimize disruption to legitimate traffic. Key responsibilities include reproducing exploits in controlled environments, performing targeted penetration testing, and building research tools to automate validation. You will utilize SQL to investigate large datasets and languages such as Python, Go, or Rust for automation. The work focuses on the detection lifecycle, addressing common vulnerability classes like SQL injection, cross-site scripting, and remote code execution to protect internet properties from emerging exploits.
Analyze public CVEs, proof-of-concept exploits, and observed attacks to identify root causes and mitigation opportunities.
Design, test, and deploy WAF managed rules and exploit signatures to protect against evolving threats.
Investigate customer reports and telemetry to reproduce issues and refine detections while minimizing false positives.
Perform targeted penetration testing and adversarial testing to identify detection gaps and evaluate mitigation resistance.
Build tools and automated test cases to accelerate exploit analysis, rule validation, and regression testing.
Use SQL and production data to measure rule efficacy, track attack trends, and assess performance.
Document technical findings and mitigation decisions for internal research reports and public-facing blogs.
What we're looking for
You have hands-on experience in web application security, vulnerability research, or detection engineering.
You have experience writing and improving WAF rules, exploit signatures, or comparable detection logic.
You understand HTTP/HTTPS, web application/proxy request processing, and common vulnerability classes like SQLi, XSS, RCE, SSRF, and insecure deserialization.
You can analyze vulnerability advisories, reproduce exploits in controlled environments, and identify request characteristics distinguishing exploitation from legitimate traffic.
You use SQL to investigate large datasets and a language such as Python, Go, or Rust to build research tools and automate analysis.
You can communicate technical findings clearly to both technical and non-technical audiences.
You use AI fluently in research and coding workflows with the judgment to independently validate outputs.
Export control laws, including the U.S. Export Administration Regulations.
CCure 9000
Victor Video Management
SQL Server Management Studio
Python
C#
C++
Microsoft Office 365
Microsoft Power Apps
SQL
Lenel
Genetec
Software House
Johnson Controls
IoT
AI
Access Control
CCTV
Risk Management Framework (RMF)
Information Assurance
Xacta IA Manager
eMASS
Assessment and Authorizations (A&A)
System Security Plans (SSP)
Plans of Action and Milestones (POA&M)
Firewall
Network Service Requests (NSR)
Port Service Requests (PSR)
DOD 8140
TS/SCI
SCIF
AF DCGS
Risk Management Framework (RMF)
AWS
Azure
FedRAMP
ACAS
Nessus
STIGs
Vulnerability Management
Information Assurance
Security Technical Implementation Guides
Continuous Monitoring
System Security Plan (SSP)
Plans of Action and Milestones (POA&M)
DoD 8570
IAM Level II