Job Description & Details
This is a heavy-duty AppSec consulting gig sitting right at MTA Headquarters in New York, focused on hardening high-value public-facing infrastructure. You won't just be writing policies on paper; you'll be actively shaping how enterprise product and DevOps teams handle security across the SDLC. If you know your way around traffic inspection and enterprise edge security, this is a solid place to make an immediate impact.
What You'll Actually Be Doing
Expect to spend a solid chunk of your day wrangling edge protection, specifically onboarding, tuning, and monitoring traffic through Cloudflare and Akamai WAF platforms. You'll act as the bridge between development squads and cybersecurity leadership, conducting secure architecture reviews and helping developers fix vulnerabilities without grinding feature velocity to a halt. You'll also be deep in the trenches analyzing HTTP traffic, tuning rulesets to drop bot traffic and DDoS attacks, and building out telemetry and metrics from your security tooling.
The Core Tech Stack
Your bread and butter here will be deep, hands-on experience with Cloudflare WAF (rulesets, bot management, logpush) and Akamai WAF (KSD, Property Manager, Bot Manager). You also need a sharp command of SAST, DAST, and SCA tooling like Checkmarx or BurpSuite, paired with a rock-solid understanding of the OWASP Top 10. Because you'll be auditing modern cloud architectures on AWS and Azure, knowing how to parse raw HTTP payloads and interpret security telemetry from SIEM tools is non-negotiable.
Interview Expectations
When you sit down with the hiring team, expect them to test your ability to balance security with developer velocity. They might ask you to walk through how you would handle a sudden spike in sophisticated layer 7 DDoS or credential-stuffing attacks on a critical Akamai-backed endpoint without blocking legitimate commuters. They are secretly looking for pragmatic engineers who don't just throw alerts at developers, but who understand how to write fine-tuned rules and mentor teams on secure coding practices.
Application Advice
Make sure your resume doesn't just list tools, but explicitly highlights your hands-on experience tuning Cloudflare and Akamai WAF policies in high-traffic production environments. Use exact keywords from the job description like 'Bot Manager', 'KSD', 'OWASP Top 10', and 'SAST/DAST' so you easily clear the initial ATS filters. Frame your past experience around how you enabled development teams to move faster while keeping the infrastructure locked down.