DCSC Automation Specialist

About the role

Cloudflare is looking for an Automation Specialist to transform how our global Data Center Security Compliance (DCSC) team operates. This critical role is part of the Infrastructure Operations organization, which is responsible for building, scaling, and running Cloudflare's data center and network infrastructure across 700+ sites worldwide.

Responsibilities

• Portal Automation & User List Extraction
  • Design and maintain automated scripts (Playwright, Puppeteer, or equivalent) that log into vendor data center portals, extract user access lists, and feed structured output into the DCSC Portal and comparison pipelines.
  • Build fallback handling for portals that block or rate-limit automated access; document exceptions and maintain a coverage registry tracking automation status per portal.
  • Operationalize extraction jobs on a recurring cadence aligned to QAR and MAR cycles, with alerting for failures and drift.
• ACL Reconciliation & Diff Engine
  • Build tooling that ingests portal-extracted user lists and compares them against the master Access Control List (ACL), automatically surfacing discrepancies.
  • Route confirmed discrepancies directly to pre-populated Jira tickets for human review and action.
  • Ensure all comparison runs produce immutable, timestamped records suitable for SOC 2, ISO 27001, and FedRAMP evidence requirements.
• Attestation & Evidence Automation
  • Own and extend the attestation workflow within the DCSC Portal, including automated cycle triggering, manager notification, time-stamped confirmation capture, and exception escalation.
  • Build automated pipelines that compile audit-ready evidence packages for SOC 2, ISO 27001, FedRAMP, ISMAP, and IRAP control cycles.
  • Work directly with GRC counterparts to validate that automated evidence formats meet auditor and regulatory requirements before deployment.
• AI-Assisted Anomaly Detection & Triage
  • Implement LLM-based review passes over QAR cycle output to surface patterns warranting human escalation.
  • Build automation that reads incoming Jira onboarding and offboarding tickets and generates structured, portal-specific action checklists.
  • Monitor automation output quality over time, retrain or recalibrate models as portal structures change, and maintain a feedback loop with coordinators on false positives and missed detections.
• DCSC Portal Ownership & Tooling Roadmap
  • Own the DCSC Portal as the operational runtime for all automation and workflow tooling.
  • Maintain a prioritized backlog of automation opportunities, assessed by time savings, compliance impact, and implementation complexity.
  • Produce runbooks for every automation, ensuring that no operational capability lives only in one person's head or on a local machine.

Desirable skills / Experience

• Automation Engineering: Demonstrated experience building browser automation (Playwright, Puppeteer, Selenium, or equivalent) against real-world web applications, including handling authentication flows, dynamic content, and anti-bot mitigations.
• TypeScript Proficiency: Strong skills for scripting, data wrangling, structured file I/O, and API integration. Ability to write maintainable, documented code that non-engineers can operate.
• LLM Integration: Hands-on experience integrating LLM APIs (OpenAI, Anthropic, Google, or equivalent) into production workflows for classification, drafting, summarization, or anomaly detection tasks.
• Data Engineering Fundamentals: Comfort working with structured and semi-structured data at scale, diffing datasets, normalizing inconsistent formats, and producing clean outputs for downstream audit use.
• API & Workflow Integration: Experience building integrations with ticketing or ITSM systems (Jira preferred) via REST API, including automated ticket creation, status updates, and attachment handling.
• Systems Thinking: Ability to map an end-to-end manual workflow, identify the highest-leverage automation insertion points, and ship incrementally without waiting for a perfect solution.
• Workflow Archaeology: Comfortable extracting process knowledge from subject-matter experts through structured interviews turning tribal knowledge into documented, automatable workflows.
• Bias Toward Simplicity: Strong product intuition for the minimum viable automation that delivers real time savings, rather than over-engineering for edge cases.
• Compliance Awareness: Appreciation for the stakes of accuracy in a compliance context, understanding that an incorrect ACL diff or a missing evidence artifact has real audit consequences.
• Soft Skills:
  • Communication: Able to explain automation design decisions and tradeoffs clearly to non-technical stakeholders including compliance coordinators and GRC partners.
  • Ambiguity Tolerance: Vendor portals don't come with documentation. Workflows are passed down verbally. You need to be energized by figuring things out from scratch.

Preferred Qualifications

• Experience with Cloudflare Workers or similar edge compute platforms
• Familiarity with GRC/compliance frameworks (SOC 2, FedRAMP, ISO 27001) at an operational level
• RPA tooling experience (UiPath, Power Automate) as fallback for portals that defeat headless browsers
• Prior work in infrastructure operations, data center, or physical security environments
• Experience building internal tooling or developer-facing portals