Senior Web Access Management Engineer (80-100%)

About the role

A security-focused Web Access Management team protects access to business-critical web applications and APIs, aiming for stable, secure and continuously improving access services across reverse proxy, web application firewall and customer identity platforms. This Senior Web Access Management Engineer works 80-100% of the time, designing, operating and enhancing secure access patterns in a regulated environment alongside application teams, security architects, platform engineers and service owners.

Key responsibilities

• Operate and enhance Web Access Management services, including reverse proxy, access gateway, web application firewall and customer identity components.
• Design, build and troubleshoot secure authentication and single sign-on flows using OpenID Connect, OAuth2 and SAML 2.0.
• Configure routing, TLS certificates, access policies, authorization mappings and upstream integrations for web applications and APIs.
• Tune and maintain web application firewall policies, including OWASP Core Rule Set handling, exceptions, anomaly scoring and change control.
• Contribute to operational stability, automation, monitoring, incident response, upgrades, disaster recovery readiness and continuous service improvement.

Required profile

• Strong hands-on knowledge of reverse proxy or access gateway platforms, including TLS handling, routing, header and cookie management, session handling and high availability.
• Practical experience with web application firewalls, ModSecurity, OWASP Core Rule Set, rule tuning, false-positive handling and secure publishing patterns.
• Solid understanding of identity and access management, identity lifecycle, multi-factor authentication, secure account recovery, token validation and authorization models.
• Analytical, security-minded and collaborative approach with good communication skills; fluent English is required, German is an advantage.

Required skills

• OpenID Connect, OAuth2, SAML 2.0, JWT, PKCE, scopes, claims, certificates, metadata and key rotation.
• ModSecurity and OWASP Core Rule Set.