Senior Threat Intelligence Engineer
CloudflareResponsibilities
- Research, collect, and analyze threat intelligence from OSINT, commercial feeds, dark web sources, and internal security events.
- Design, implement, and maintain machine-learning detection use cases across data ingestion, training, deployment, and inference.
- Profile threat actors and their tactics, techniques, and procedures using frameworks such as MITRE ATT&CK.
- Produce and disseminate actionable intelligence reports and briefings for technical teams and executive leadership.
- Engineer the ingestion, enrichment, correlation, and contextualization of indicators of compromise and indicators of attack.
- Develop SOAR automation workflows and playbooks for incident triage, alert enrichment, vulnerability management, and threat response.
- Integrate security tools through APIs and scripting, primarily Python, and improve repetitive security processes through scalable automation.
- Support incident response with threat context and collaborate with detection engineers, security engineers, and software developers.
Requirements
- At least 4 years of hands-on experience in security engineering, cyber threat intelligence, or security automation.
- Strong proficiency in at least one scripting or programming language for automation, such as Python.
- Deep understanding of the cyber kill chain, threat actor TTPs, common attack vectors, networking protocols, and operating system internals.
- Proven experience designing SOAR playbooks and integrating security tools through APIs.
- Experience with commercial and open-source threat intelligence platforms and threat feeds.
- Familiarity with security services and automation in AWS, Azure, or GCP.
- Experience threat hunting in complex networks, validating vulnerability reports, performing impact analysis, and operationalizing threat data.
- Experience with malware analysis and reverse engineering, threat intelligence data analysis and visualization, and Infrastructure-as-Code tools such as Terraform is desirable.
- Strong communication, autonomy, ownership, urgency, partnership-building, and ability to navigate ambiguity are expected; understanding nation-state motivations and capabilities is highly desirable.
Benefits
- Medical/Rx, dental, and vision insurance.
- Flexible spending accounts, commuter spending accounts, fertility and family-forming benefits, mental health support, Employee Assistance Program, and global travel medical insurance.
- Short- and long-term disability insurance, life and accident insurance, a 401(k) retirement savings plan, and an employee stock participation plan.
- Flexible paid time off and leave programs including parental, pregnancy health, medical, and bereavement leave.
- The position is based in Austin, US; candidates advancing to the offer stage may be asked to attend an in-person interview at a Cloudflare office or hub.
- The role is eligible to participate in Cloudflare’s equity plan.
Categories
About Cloudflare
Cloudflare, Inc. (NYSE: NET) is the leading connectivity cloud company. It empowers organizations to make their employees, applications and networks faster and more secure everywhere, while reducing complexity and cost. Cloudflare’s connectivity cloud delivers the most full-featured, unified platform of cloud-native products and developer tools, so any organization can gain the control they need to work, develop, and accelerate their business. Powered by one of the world’s largest and most interconnected networks, Cloudflare blocks billions of threats online for its customers every day. It is trusted by millions of organizations – from the largest brands to entrepreneurs and small businesses to nonprofits, humanitarian groups, and governments across the globe.