Web Application Security Engineer

Job Seekers can review the Job Applicant Privacy Policy by clicking here.

Job Description:

Summary

The Web Application Security Engineer is a critical member of the cybersecurity team responsible for protecting web-based applications hosted on-premises and in the cloud. This role plays a key part in strengthening the organization’s application security posture by onboarding web applications into a Content Delivery Network (CDN), configuring and maintaining WAF protections, and executing Dynamic Application Security Testing (DAST) scans.The engineer designs and deploys secure WAF configurations to defend against emerging threats without disrupting business operations. They are also responsible for identifying, mitigating, and escalating vulnerabilities through proactive monitoring and testing. This role collaborates closely with security operations, application development teams, and third-party providers to ensure comprehensive application protection across environments.

Essential Functions

• Lead the onboarding of web applications into a CDN, ensuring proper security policy integration and optimized delivery.
• Manage WAFs deployed on-premises, in the cloud, or in hybrid environments, including those co-managed with external service providers. Configure, maintain, and tune WAF rules to protect against web application threats, including OWASP Top Ten risks.
• Set up and execute DAST scans on web applications to identify vulnerabilities in runtime environments, validate WAF coverage, and provide actionable remediation guidance. Collaborate with development, infrastructure, and SOC/IR teams to ensure findings are triaged, addressed, and documented.
• Monitor application traffic and threat activity, leveraging automation and analytics to detect and respond to anomalies. Perform continuous testing and tuning of WAF policies based on threat intelligence, logs, and scan results.
• Contribute to incident response efforts related to application-layer attacks and vulnerabilities.
• Develop and maintain documentation related to WAF policies, scan results, application mappings, and remediation plans.

Additional Responsibilities

• Perform other duties as assigned.

Skills and Abilities

• Excellent communication skills, both verbal and written, and the ability to work effectively with cross-functional teams., Required
• Ability to create and maintain professional relationships within all levels of the organization (peers, work groups, customers, supervisors)., Required
• Ability to work independently and as a member of a team, Required
• Flexibility to operate and self-driven to excel in a fast-paced environment, Required
• Capable of multi-tasking, highly organized, with excellent time management skills, Required

Qualifications

• Bachelor's degree in computer science, Information Security, or a related field, Required
• 5 years or more experience with WAF technologies (Akamai Kona, Azure App Gateway, Cloudflare)., Required
• 7 years or more experience with DAST tools such as Burp Suite and enterprise scanning platforms such as InsightAppSec., Required
• 5 years or more Proficiency with applications, databases, web services, authentication and middleware servers., Required
• 5 years or more Aptitude with one or more scripting languages (e.g., Python, PowerShell, Bash)., Required
• 5 years or more Proven experience in diagnosing, isolating, resolving complex issues and recommending/implementing strategies to resolve problems, Required
• 5 years or more Understanding of OWASP Top Ten, threats and vulnerabilities, and tactics used to compromise applications., Required
• 5 years or more Skilled in analyzing logs to identify and interpret attack patterns accurately., Required
• Hands-on experience with CDN platforms and integration of security policies within those services. Expert, Required
• Advanced understanding of web application security, including common attack vectors and secure design principles. Expert, Required
• Knowledge of CI/CD pipelines and integration of security testing tools. Advanced, Required
• Strong troubleshooting skills of web application client and server technologies, forward and reverse proxies, static content caching, DNS, etc Expert, Required
• Experience in risk management findings, vulnerability prioritization, threat modeling, and mitigation strategy, advanced required Advanced, Required
• & CISSP, OSCP, OSWE, or other industry-leading certifications, Preferred

Travel

• No

Job Category

Compensation Information:

The compensation offered to a candidate may be influenced by a variety of factors, including the candidate’s relevant experience; education, including relevant degrees or certifications; work location; market data/ranges; internal equity; internal salary ranges; etc. The position may also be eligible to receive an annual bonus, commission, and/or long-term incentive plan based on the level and/or type. Compensation ranges for the position are below:

Pay Type:

Minimum Pay Range:

Maximum Pay Range:

Benefits Information:

For all Full-time positions only: Ryder offers comprehensive health and welfare benefits, to include medical, prescription, dental, vision, life insurance and disability insurance options, as well as paid time off for vacation, illness, bereavement, family and parental leave, and a tax-advantaged 401(k) retirement savings plan.

Ryder is proud to be an Equal Opportunity Employer and Drug Free workplace.

All qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, sex, sexual orientation, gender identity, age, status as a protected veteran, among other things, or status as a qualified individual with disability.

Important Note:

Some positions require additional screening that may include employment and education verification; motor vehicle records check and a road test; and/or badging or background requirements of the customer to which you are assigned.

Security Notice for Applicants:

Ryder will only communicate with an applicant directly from a [@ryder.com] email address and will never conduct an interview online through a chat type forum, messaging app (such as WhatsApp or Telegram), or via an online questionnaire. During an interview, Ryder will never ask for any form of payment or banking details and will never solicit personal information outside of the formal submitted application through www.ryder.com/careers.

Should you have any questions regarding the application process or to verify the legitimacy of an interview or Ryder representative, please contact Ryder at careers@ryder.com or 800-793-3754.

Current Employees:

If you are a current employee at Ryder, please click here to log in to Workday to apply using the internal application process.

Job Seekers can review the Job Applicant Privacy Policy by clicking here.