The Cyber Security Engineer - Network (WAF & DDoS) is responsible for the design, implementation, operation and continual improvement of Web Application Firewall and Distributed Denial-of-Service protection capabilities across internet-facing services, applications and APIs.

The role will engineer resilient edge-security controls that protect confidentiality, integrity and availability of critical payment and digital services. This includes establishing secure WAF policies, DDoS detection and mitigation patterns, bot and API protections, traffic visibility, alerting and operational response processes across on-premises, cloud and hybrid environments.

The engineer will work closely with Network, Cloud, Application, Architecture and Security Operations teams to onboard services, tune controls, troubleshoot complex traffic flows, respond to incidents and deliver security improvements without creating unacceptable customer or service impacts.

The role is suited to an experienced network security engineer who combines strong technical capability with disciplined change management, testing, documentation and risk management within a regulated and highly available workplace.

Responsibilities

- Develop and maintain the target-state architecture for WAF, DDoS and edge-security capabilities across on-premises, cloud and hybrid environments.
- Define secure and reusable architecture patterns for reverse proxies, Content Delivery Networks, cloud and on-premises WAF platforms, DNS security, bot management, API protection, rate limiting and DDoS mitigation.
- Establish security engineering principles, design standards and control requirements for protecting internet-facing websites, client portals, applications, APIs and critical payment services.




- Assess proposed network, cloud, application and API changes for WAF, DDoS, service availability and internet-exposure implications.
- Provide practical security architecture advice that balances cyber risk, operational resilience, application performance, customer experience and business requirements.
- Contribute to security architecture reviews, threat assessments, threat modelling and technology selection for internet-facing services.
- Define strategic uplift opportunities to consolidate security controls, reduce complexity and retire unsupported, duplicated or ineffective WAF and DDoS technologies.
- Maintain alignment between WAF and DDoS capabilities, cyber security strategy, enterprise architecture and regulatory obligations.

Strategy and Architecture

- Develop and maintain the target-state architecture for WAF, DDoS and edge-security capabilities across on-premises, cloud and hybrid environments.
- Define secure and reusable architecture patterns for reverse proxies, Content Delivery Networks, cloud and on-premises WAF platforms, DNS security, bot management, API protection, rate limiting and DDoS mitigation.
- Establish security engineering principles, design standards and control requirements for protecting internet-facing websites, client portals, applications, APIs and critical payment services.
- Assess proposed network, cloud,



application and API changes for WAF, DDoS, service availability and internet-exposure implications.
- Provide practical security architecture advice that balances cyber risk, operational resilience, application performance, customer experience and business requirements.
- Contribute to security architecture reviews, threat assessments, threat modelling and technology selection for internet-facing services.
- Define strategic uplift opportunities to consolidate security controls, reduce complexity and retire unsupported, duplicated or ineffective WAF and DDoS technologies.
- Maintain alignment between WAF and DDoS capabilities, cyber security strategy, enterprise architecture and regulatory obligations.

Engineering and Implementation

- Design, configure, deploy and support WAF and DDoS protection services for internet-facing websites, client portals, APIs and critical business services.
- Onboard applications and APIs to WAF and DDoS services through service discovery, traffic-flow mapping, DNS and certificate coordination, policy design, security testing, production cutover and post-implementation support.
- Create and implement WAF security policies using managed rule sets, custom signatures, positive-security controls, virtual patching, geographic and IP restrictions, HTTP method controls, file-type restrictions, API schema validation and rate limiting.
- Engineer controls to protect against volumetric, protocol-based and application-layer denial-of-service attacks.
- Design and implement traffic diversion, clean-pipe and scrubbing-service arrangements for responding to DDoS attacks.
- Implement bot-management, reputation-based, behavioural

📌 Network Security Engineer (Sydney)
🏢 Preacta
📍 Sydney