Network Security Engineer

The Cyber Security Engineer - Network (WAF & DDoS) is responsible for the design, implementation, operation and continual improvement of Web Application Firewall and Distributed Denial-of-Service protection capabilities across internet-facing services, applications and APIs. The role will engineer resilient edge-security controls that protect confidentiality, integrity and availability of critical payment and digital services. This includes establishing secure WAF policies, DDoS detection and mitigation patterns, bot and API protections, traffic visibility, alerting and operational response processes across on-premises, cloud and hybrid environments. The engineer will work closely with Network, Cloud, Application, Architecture and Security Operations teams to onboard services, tune controls, troubleshoot complex traffic flows, respond to incidents and deliver security improvements without creating unacceptable customer or service impacts. The role is suited to an experienced network security engineer who combines strong technical capability with disciplined change management, testing, documentation and risk management within a regulated and highly available environment.

Responsibilities:

Strategy and Architecture

- Develop and maintain the target-state architecture for WAF, DDoS and edge-security capabilities across on-premises, cloud and hybrid environments.
- Define secure and reusable architecture patterns for reverse proxies, Content Delivery Networks, cloud and on-premises WAF platforms, DNS security, bot management, API protection, rate limiting and DDoS mitigation.
- Establish security engineering principles, design standards and control requirements for protecting internet-facing websites, client portals,



applications, APIs and critical payment services.
- Assess proposed network, cloud, application and API changes for WAF, DDoS, service availability and internet-exposure implications.
- Provide practical security architecture advice that balances cyber risk, operational resilience, application performance, customer experience and business requirements.
- Contribute to security architecture reviews, threat assessments, threat modelling and technology selection for internet-facing services.
- Define strategic uplift opportunities to consolidate security controls, reduce complexity and retire unsupported, duplicated or ineffective WAF and DDoS technologies.
- Maintain alignment between WAF and DDoS capabilities, cyber security strategy, enterprise architecture and regulatory obligations.

Engineering and Implementation

- Design, configure, deploy and support WAF and DDoS protection services for internet-facing websites, client portals, APIs and critical business services.
- Onboard applications and APIs to WAF and DDoS services through service discovery, traffic-flow mapping, DNS and certificate coordination, policy design, security testing, production cutover and post-implementation support.
- Create and implement WAF security policies using managed rule sets, custom signatures, positive-security models, virtual patching, rate limiting,



IP reputation, geographic controls, bot mitigation and API protection.
- Engineer controls to protect against volumetric, protocol-based and application-layer denial-of-service attacks.
- Design and implement traffic diversion, clean-pipe and scrubbing-service arrangements for responding to DDoS attacks.
- Implement bot-management, reputation-based, behavioural and automated traffic controls to protect web applications and APIs from malicious or abusive activity.
- Configure TLS certificates, certificate chains, cipher suites, protocol versions, trusted proxy headers, source IP preservation and secure connectivity between edge platforms and backend services.
- Establish and maintain secure configuration baselines for WAF, DDoS, CDN and related edge-security platforms.
- Perform WAF rule testing, configuration validation and security-control verification using approved testing techniques and tools.
- Maintain evidence demonstrating that recent and changed controls have been tested and are operating effectively before production deployment.

Security Operations and Incident Response

- Monitor WAF, CDN and DDoS telemetry to identify attacks, abnormal traffic patterns, false positives, control gaps, platform capacity concerns and emerging threats.
- Establish application and network traffic baselines, detection thresholds and automated mitigation controls for abnormal or malicious activity.
- Integrate WAF and DDoS logs, alerts and platform-health telemetry with Microsoft Sentinel or the relevant SIEM, Security Operations Centre workflows, service monitoring, incident-management processes, dashboards and operational reporting.

📌 Network Security Engineer (Sydney)
🏢 Preacta Recruitment
📍 Sydney