Network Security Engineer - F5

Portland resourcing are looking for an individual F5 Web Application Firewall (WAF) expert to help us create and/or tune existing WAF policies on our F5 BIG-IP reverse Proxy (with the WAF/ASM module). The standard F5 WAF policies generate a large number of false positives with our in-house applications. We're looking for someone who can identify the cause(s) of these false positives, and propose the required WAF policy changes. The candidate should be able to consider operational aspects in his/her proposals.

Required Knowledge and Experience

Personal Skills

Mandatory
*Normal social skills, able to work in a team of professionals under pressure, good communication skills, technical writing skills
*Autonomous
*Able to interact with business users, proven track - record of meeting deadlines, planning and organisation skills
*Documentation of projects and solutions

Business experience required

Mandatory
*Minimum 5 years of professional experience and expertise in Security Network engineering, preferably with experience in Web Application Firewalls
Preferable
*Track record of WAF experience(s)

Technical experience required

Mandatory
*Expert in F5 BIG-IP platform, and in particular with the WAF (ASM) module
*Knowledge of web protocols (HTTP, )
Preferable
*Hands-on experience with F5 ASM module, WAF policy tuning/creation.
Functional experience required
Mandatory
*Analytical mindset for Security solution analysis.
Preferable
*Awareness of ITIL concepts, able to take operational aspects into account

1. Analyze WAF logs and propose policy changes to allow the activation of the blocking mode.
*Currently, the default F5 WAF policy templates generate a large number of false positives, preventing us from using the WAF in blocking mode. After careful analysis, the policies must be fine-tuned to avoid blocking AG in-house applications, and after some dry-run period (in alarm-only mode), blocking will be (re)activated.

2. Propose WAF management & maintenance procedures
*It must still be determined if one single policy fits all, or if a 'per URL' (or URL groups) filtering is needed. This will probably depend on the outcome of the logs analysis. Adding new websites/applications in the WAF must obviously remain manageable, and limit impact on existing applications.

Languages
English
Dutch
French

Dutch and French basic