Operational Engineer L 2 – Web Application Security

Your role is to lead and oversee Cybersecurity analysis, activities monitoring and investigations within a shift.  You will handle advanced incidents and service requests and guide Level 1 engineers and provide expertise in complex troubleshooting scenarios. Additionally you will coordinate with escalation engineers on the investigation and resolution of critical cybersecurity incidents as well as ensure accurate triage, timely escalation and resolution within SLAs. This role is on-site and based on shift rotation within a 24x7 Operation.  

What you will do: 
 

- Address escalated incidents and service requests.  
- Guide Level 1 engineers in troubleshooting.  
- Ensure timely resolution and fulfilment of escalated issues.  

- Maintain clear documentation of complex incidents.  

- Monitor external threat data sources to maintain the cyber network defence threat conditions and determine which security issues may have an impact on the enterprise.  

- Perform a detailed analysis of cyber threat adversaries and recommend preventative countermeasures.  

- Assess and identify Advance Persistent Threat (APT) activities.  
- Maintain and support the shift log for effective shift handover.  

- Monitor and review triage activities performed by the L1 analysts and ensure accurate closure. 

- Assist in creating playbooks and updating the knowledge base repository.  

Specific knowledge and skills for the role of Operational Engineers Level 2 - Web Application Security. 

The following are critical skills required to be successful in this role: 

- Configuration and Deployment: Proficiency in setting up and deploying both WAFs and Network Firewalls within the network infrastructure, understanding their roles in protecting web applications and securing the network perimeter. 
 

- Policy Management: Creation and management of security policies for both WAFs and Network Firewalls, tailoring rules to protect against various threats (such as SQL injection, XSS, malware, unauthorized access) and ensuring accurate traffic filtering. 
 

- Rule Configuration and Monitoring: Configuration and monitoring of firewall rules, both for web application traffic and network traffic, ensuring effective filtering, identifying potential security threats, and performing basic analysis to detect anomalies. 
 

- Incident Response and Collaboration: Understanding of incident response protocols related to both WAFs and Network Firewalls, including initial response to alerts, incident identification, reporting, and collaboration with teams to address security events. 
 

- Documentation and Reporting: Maintaining documentation for both WAF and Network Firewall configurations, policies, and incident responses, as well as generating basic reports on firewall activities and security incidents for future reference.