WASP Efficacy Testing Engineer

Location: Kraków, Poland (Hybrid – 6 days per month in the office)
Contract type: B2B

About the Role

We are looking for an experienced WAF Security Engineer to help strengthen web application and API security across complex, globally distributed environments.

In this role, you will focus on designing, developing, testing, and implementing advanced Web Application Firewall (WAF) security solutions. You will play a key role in identifying security vulnerabilities, developing custom protection rules, and improving defenses against sophisticated web-based attacks.

The ideal candidate has a strong background in ethical hacking, application security, and security testing automation.

Key Responsibilities

• Design, develop, and optimize custom WAF rules to protect web applications and APIs against security threats.

• Analyze web-based attack techniques, vulnerabilities, and WAF bypass methods to develop effective mitigation strategies.

• Conduct technical evaluations and security testing of WAF solutions, rulesets, and new features.

• Develop automated security tests for standard and custom WAF rules.

• Integrate security testing into CI/CD pipelines to support DevSecOps practices.

• Perform Proofs of Concept (PoCs) and evaluate new WAF security capabilities.

• Apply ethical hacking and penetration testing techniques to identify potential security gaps.

• Reverse-engineer attack techniques and develop appropriate detection and prevention mechanisms.

• Monitor emerging web security threats and recommend effective countermeasures.

• Maintain technical documentation and security testing reports.

Requirements

• Strong experience in ethical hacking, penetration testing, or application security.

• Hands-on knowledge of Web Application Firewalls (WAF), including custom rule development, configuration, and testing.

• Deep understanding of web application and API security threats, attack techniques, and mitigation strategies.

• Strong knowledge of OWASP Top 10 vulnerabilities.

• Experience identifying and mitigating WAF, IPS, and cloud security vulnerabilities.

• Proficiency in at least one programming or scripting language.

• Experience developing automated security tests and integrating them into CI/CD pipelines.

• Good understanding of networking, cloud security, firewalls, and web technologies.

• Familiarity with DevSecOps / DevOps principles and practices.

• Understanding of Agile methodologies.

• Strong analytical, problem-solving, and communication skills.

What We Offer

• B2B contract

• Hybrid working model – 6 days per month from the office in Kraków

• LuxMed private medical care

• MyBenefit cafeteria platform

• Dedicated Contractor Care support throughout your cooperation