Senior Threat Intelligence Engineer
Cloudflare2 months ago
Responsibilities
- Research, collect, and analyze threat intelligence from OSINT, commercial feeds, dark web sources, and internal security events.
- Design, implement, and maintain machine-learning detection use cases across data ingestion, training, deployment, and inference.
- Profile threat actors and their tactics, techniques, and procedures using frameworks such as MITRE ATT&CK.
- Produce and disseminate actionable intelligence reports and briefings for technical teams and executive leadership.
- Engineer the ingestion, enrichment, correlation, and contextualization of indicators of compromise and indicators of attack.
- Develop SOAR automation workflows and playbooks for incident triage, alert enrichment, vulnerability management, and threat response.
- Integrate security tools through APIs and scripting, primarily Python, and improve repetitive security processes through scalable automation.
- Support incident response with threat context and collaborate with detection engineers, security engineers, and software developers.
Requirements
- At least 4 years of hands-on experience in security engineering, cyber threat intelligence, or security automation.
- Strong proficiency in at least one scripting or programming language for automation, such as Python.
- Deep understanding of the cyber kill chain, threat actor TTPs, common attack vectors, networking protocols, and operating system internals.
- Proven experience designing SOAR playbooks and integrating security tools through APIs.
- Experience with commercial and open-source threat intelligence platforms and threat feeds.
- Familiarity with security services and automation in AWS, Azure, or GCP.
- Experience threat hunting in complex networks, validating vulnerability reports, performing impact analysis, and operationalizing threat data.
- Experience with malware analysis and reverse engineering, threat intelligence data analysis and visualization, and Infrastructure-as-Code tools such as Terraform is desirable.
- Strong communication, autonomy, ownership, urgency, partnership-building, and ability to navigate ambiguity are expected; understanding nation-state motivations and capabilities is highly desirable.
Benefits
- Medical/Rx, dental, and vision insurance.
- Flexible spending accounts, commuter spending accounts, fertility and family-forming benefits, mental health support, Employee Assistance Program, and global travel medical insurance.
- Short- and long-term disability insurance, life and accident insurance, a 401(k) retirement savings plan, and an employee stock participation plan.
- Flexible paid time off and leave programs including parental, pregnancy health, medical, and bereavement leave.
- The position is based in Austin, US; candidates advancing to the offer stage may be asked to attend an in-person interview at a Cloudflare office or hub.
- The role is eligible to participate in Cloudflare’s equity plan.
Categories
About Cloudflare
Cloudflare builds a global network that provides CDN, DDoS mitigation, DNS, Zero Trust security, and developer/edge computing tools for organizations of all sizes. It sells subscriptions to its cloud-based platform and usage-based services that protect and accelerate web sites, APIs, and corporate networks, plus serverless apps via Workers. Founded in 2009 and headquartered in San Francisco, it is a public company traded on the NYSE (ticker: NET).