Detection & Mitigation Engineer

At Cloudflare, we are on a mission to help build a better Internet. Today the company runs one of the world’s largest networks that powers millions of websites and other Internet properties for customers ranging from individual bloggers to SMBs to Fortune 500 companies. Cloudflare protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare have web traffic routed through its intelligent global network, which gets smarter with every request, resulting in significant performance improvements and decreased spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures list and ranked among the World’s Most Innovative Companies by Fast Company.

We value candidates who spot "normalized" problems and use AI-native curiosity to create solutions with the latest tools. Our culture thrives on iteration, leveraging AI to ship faster and improve continuously, ensuring every enhancement is shared across the team. If you prioritize curiosity over bureaucracy and see AI as a partner in solving tough problems, you’ll fit right in.

Available location: Austin, TX

About The Department

Cloudforce One is Cloudflare’s threat operations and research team, responsible for identifying and disrupting cyber threats ranging from sophisticated cyber criminal activity to nation-state sponsored advanced persistent threats (APTs). The team works closely with external organizations and internal Cloudflare teams, developing operational tradecraft and expanding threat intelligence sources to enable expedited threat hunting and remediation. Members leverage an unparalleled set of data points from one of the world’s largest global networks, analyzing them at scale to synthesize actionable threat intelligence that protects customers.

About the Role

Cloudflare is seeking a talented Security Detections Engineer to identify, track, and mitigate sophisticated threats and abuse across our global platform. In this role, you will examine and mitigate threats in real-time, using emerging technologies to build detections that protect millions from attacks. Your work will help push the boundaries of today’s security landscape. As a Security Detections Engineer, your analytical thinking and quick action will be critical to our success. You will identify Tactics, Techniques, and Procedures (TTPs) of evolving cyber threats and collaborate with team members to develop innovative ways to present and interact with our unique insights. Your efforts will directly disrupt adversaries targeting our global customer base.

Responsibilities

• Analyze and mitigate threats in real-time to protect Cloudflare’s platform and customers.
• Identify Tactics, Techniques, and Procedures (TTPs) of ongoing and evolving cyber attacks.
• Develop new and innovative detections to track and disrupt adversary activity.
• Collaborate with team members to improve threat intelligence presentation and interaction.
• Synthesize technical findings into actionable intelligence for both technical and executive stakeholders.
• Document and communicate threat intelligence through graphical and verbal representations.

Requirements

• Experience in one of the following: Data analysis, Metadata analysis, or Network Traffic analysis.
• Passion for analyzing attacker TTPs at varying levels.
• Understanding of the latest security trends as they relate to platform threats and abuse.
• Experience using comprehensive data analysis platforms and rule configuration.
• Knowledge of the cyber threat landscape, cyber intelligence, and threat actor techniques.
• Experience tracking and analyzing cyber campaigns using technical Indicators of Compromise (IOCs).
• Working knowledge of SQL and devising SQL queries.
• Python or other scripting experience.
• Ability to synthesize technical information and document it in a non-technical manner.
• Strong oral and written communication skills for technical and executive audiences.
• Desire to learn, improve, and share knowledge with the team.

Skills

• Working knowledge of authentication protocols (e.g., email, network, application) and related header/log analysis.
• Experience analyzing, tracking, and defending against cyber attacks, including phishing, malware, and abuse.
• Strong understanding of the cyber threat landscape, with expertise in advanced persistent threat (APT) groups.
• Working knowledge of OSI Layers, TCP/UDP/ICMP, DNS, HTTP/HTTPS, SMTP/SMTPS, SSH/SFTP/SCP, and FTP.
• Familiarity with regular expressions and their application in tracking malicious activity.
• Experience with detection development using YARA, Snort, Suricata, or equivalent languages.
• Vibe coding experience for building tools and applications.
• BS in Computer Science, Information Technology, Information Security, Computer Security, or Information Systems.

Benefits

Cloudflare offers a comprehensive benefits package to support you and your family, including:

• Health & Welfare Benefits:
  • Medical/Rx Insurance
  • Dental Insurance
  • Vision Insurance
  • Flexible Spending Accounts
  • Commuter Spending Accounts
  • Fertility & Family Forming Benefits
  • On-demand mental health support and Employee Assistance Program
  • Global Travel Medical Insurance
• Financial Benefits:
  • Short and Long Term Disability Insurance
  • Life & Accident Insurance
  • 401(k) Retirement Savings Plan
  • Employee Stock Participation Plan
• Time Off:
  • Flexible paid time off covering vacation and sick leave
  • Leave programs, including parental, pregnancy health, medical, and bereavement leave

Equity

This role is eligible to participate in Cloudflare’s equity plan.

What Makes Cloudflare Special?

We’re a highly ambitious, large-scale technology company with a soul. Fundamental to our mission is protecting the free and open Internet through initiatives like:

• Project Galileo: Since 2014, we’ve equipped over 2,400 journalism and civil society organizations in 111 countries with tools to defend against censorship attacks—at no cost.
• Athenian Project: Created in 2017 to provide state and local governments with free, high-level protection and reliability for election information and voter registration. We’ve supported over 425 local government election websites across 33 states.
• 1.1.1.1: A faster, more secure, and privacy-centric public DNS resolver available to everyone. We don’t store client IP addresses, and no user data is sold to advertisers.