WAF Security Engineer

Salary: £44,000 - 76,000 per year

Requirements:

• We are looking for a strong engineering mindset with hands-on experience of edge, on-premises or cloud-native WAF technologies.
• We need a solid understanding of networking and web fundamentals, including HTTP/S, DNS, TLS and platform security concepts.
• Experience in any of the following is required: Application Security, API Security, Bot Protection, and Layer 7 DDoS mitigation.
• Strong automation and scripting skills are needed, with Python preferred.
• Practical experience using Infrastructure-as-Code tools is required, with Terraform preferred.
• Experience with modern CI/CD pipelines is required.
• We need the ability to contribute to complex technical investigations, diagnose issues under pressure and develop robust solutions.
• Confidence to influence engineering decisions and contribute to the teams technical direction is required.
• Professional-level cloud certifications and/or recognised security or network engineering accreditations would be beneficial.
• Demonstrable experience with cloud-based data warehouse technologies would be beneficial.
• Interest in or experience with developing AI solutions to augment security solutions would be beneficial.

Responsibilities:

• We design, implement and continuously optimise WAF security controls, developing and tuning rules and policies to improve protection against emerging threats while minimising false positives and maintaining a seamless customer experience.
• We engineer new WAF capabilities using Infrastructure as Code, CI/CD pipelines and policy-as-code approaches to deliver secure, repeatable and scalable outcomes.
• We play a key role in platform modernisation and service improvements, including refactoring, automation and the reduction of technical debt.
• We drive observability and operational insight by improving monitoring, alerting and telemetry to strengthen platform reliability and incident response.
• We support the diagnosis and resolution of major incidents, partnering closely with Security Engineering, Network and Cloud teams.
• We embed secure-by-design patterns and guardrails, ensuring controls are codified, consistent and easy for platform consumers to adopt.
• We produce high-quality engineering documentation, including standards, patterns, platform guidance and runbooks, to enable self-service and repeatable delivery.
• We participate in the on-call rota, helping to maintain the operational resilience of critical services, with additional compensation provided.

Technologies:

• AI
• API
• CI/CD
• Cloud
• Data Warehouse
• HTTP
• Support
• Network
• Python
• Security
• Terraform
• WAF
• Web
• Firewall

More:

We are Lloyds Banking Group, a pioneering and fast-changing business focused on shaping finance as a force for good. This role is for a WAF Security Engineer based in Manchester, Leeds or Edinburgh, working full-time 35 hours in a hybrid pattern with at least two days per week, or 40% of time, in one of our office sites. We support flexible working and workplace adjustments for colleagues with disabilities, including hybrid working expectations in line with our Flexibility Works policy. You will join a culture that values modern engineering, automation and continuous improvement, with opportunities to shape the future of WAF and Web Application Security capabilities across the Group. We offer a wide-ranging benefits package including a pension contribution of up to 15%, annual bonus, share schemes, adaptable lifestyle benefits, 28 days holiday plus bank holidays, and wellbeing and parental leave support. We are committed to diversity, equity and inclusion and to building an inclusive workplace where our colleagues can thrive, learn and develop.

last updated 36 week of 2026