Application Security Engineer – Cloudflare & Akamai

Job Title: Senior Application Security Engineer – Cloudflare & Akamai WAF

Job Location: New York, NY (100% Onsite – 5 days per week)

Contract Length: 12+ months, with likely extension

Pay Range: $78–$88/hr W2, depending on experience

Work Schedule: 37.5 hours per week; 4 weeks of required unpaid vacation

Interview Process: 1–2 rounds, conducted virtually via Microsoft Teams or onsite in New York City, at the hiring manager's discretion

Position Overview

Our government client in New York City is seeking an experienced Senior Application Security Engineer / Consultant with deep hands-on expertise in Cloudflare WAF, Akamai WAF, application security assessments, and DevSecOps practices.

This senior-level technical role focuses on securing enterprise applications, strengthening Web Application Firewall (WAF) protections, identifying application vulnerabilities, and embedding security controls throughout the Software Development Life Cycle (SDLC).

The ideal candidate will bring extensive experience configuring and tuning Cloudflare and Akamai security platforms, evaluating application-layer threats, integrating security testing tools, and collaborating with development and infrastructure teams to improve enterprise application security.

This is a hands-on engineering opportunity for someone who enjoys solving complex security challenges, optimizing defensive controls, and protecting critical business applications.

Key Responsibilities

• Implement, configure, maintain, and optimize Cloudflare WAF, including security policies, rulesets, firewall rules, bot management, DDoS protection, DNS, and Logpush integrations.
• Administer and tune Akamai WAF, including Kona Site Defender (KSD), Property Manager, Bot Manager, and Edge DNS.
• Analyze WAF logs, HTTP requests, headers, payloads, and application traffic patterns to detect threats and improve security protections.
• Troubleshoot WAF false positives, false negatives, configuration issues, and application availability concerns.
• Conduct application security assessments, vulnerability reviews, and secure architecture evaluations.
• Identify and assess OWASP Top 10 vulnerabilities, including SQL injection, XSS, RCE, CSRF, SSRF, and insecure deserialization.
• Implement and support SAST, DAST, and Software Composition Analysis (SCA) tools, including Checkmarx, Burp Suite, Fortify, or comparable platforms.
• Integrate application security testing and secure coding practices into development workflows and DevSecOps processes.
• Collaborate with software developers, product owners, cloud engineers, and cybersecurity teams to prioritize and remediate security vulnerabilities.
• Support security controls and assessments across AWS, Microsoft Azure, SaaS platforms, and cloud-hosted applications.
• Analyze security telemetry from WAF platforms, vulnerability scanners, SIEM/SOAR solutions, and cloud logging services.
• Develop application security dashboards, operational metrics, technical reports, and vulnerability remediation documentation.
• Participate in technical security investigations, application security reviews, and continuous improvement initiatives.
• Establish repeatable security procedures, strengthen governance practices, and provide technical guidance to engineering teams.

Required Qualifications

• 5+ years of hands-on Cloudflare WAF experience, including rulesets, security policies, bot management, DNS, DDoS protection, and Logpush.
• 4+ years of hands-on Akamai WAF experience, including Kona Site Defender, Property Manager, Bot Manager, Edge DNS, and configuration testing.
• 5+ years of experience with SAST, DAST, and SCA security testing tools, such as Checkmarx, Burp Suite, Fortify, or equivalent solutions.
• Strong knowledge of OWASP Top 10, application-layer vulnerabilities, secure coding practices, and application security principles.
• Advanced experience analyzing HTTP traffic, request/response headers, payloads, and web application attack patterns.
• Hands-on experience conducting application security assessments, vulnerability analysis, and secure architecture reviews.
• Experience implementing application security controls throughout the SDLC and integrating security practices into DevOps workflows.
• Experience securing cloud-hosted and enterprise applications across AWS, Microsoft Azure, and SaaS environments.
• Ability to investigate WAF configuration issues, troubleshoot application security incidents, and recommend practical remediation solutions.
• Experience analyzing security telemetry from WAF platforms, SIEM/SOAR tools, vulnerability scanners, and cloud logging systems.
• Strong understanding of vulnerability management, security monitoring, reporting, and remediation processes.
• Excellent analytical, troubleshooting, documentation, and communication skills.
• Ability to work collaboratively with application developers, infrastructure engineers, and cybersecurity leadership.
• Ability to work onsite in New York City 5 days per week.

Preferred Qualifications

• 4–6 years of broader information security experience.
• Experience with .NET application development and security.
• Knowledge of Java development and secure coding practices.
• Experience with web application development, database security, and IT architecture.
• Familiarity with Microsoft Power Apps and associated security considerations.
• Experience designing security dashboards, operational metrics, and executive-level security reporting.
• Background supporting large-scale enterprise applications, government agencies, or other highly regulated environments.
• Experience establishing application security governance, assessment processes, and security engineering standards.

Why This Opportunity?

• Support critical application security initiatives for a major New York City government organization.
• Work directly with enterprise Cloudflare and Akamai WAF technologies.
• Take ownership of application security engineering, threat mitigation, and vulnerability remediation efforts.
• Collaborate with experienced development, infrastructure, and cybersecurity professionals.
• Contribute to DevSecOps improvements and enterprise application security modernization.
• Competitive compensation of $78–$88/hr W2.
• Long-term 12+ month contract opportunity with strong potential for extension.

About Seneca Resources

Seneca Resources is a client-focused provider of Information Technology consulting services and workforce solutions for government and commercial organizations across the United States.

Our success is driven by a strong corporate culture that values collaboration, professional growth, and career development. We offer engaging work, competitive compensation, ongoing training, and opportunities for advancement. Seneca Resources is an Equal Opportunity Employer committed to fostering a diverse and inclusive workplace.