Senior Threat Intelligence Engineer

Join Cloudflare, a leading security company, as a Senior Threat Intelligence Engineer. In this role, you will be responsible for identifying, understanding, and detecting threats to Cloudflare and its customers. You will leverage threat intelligence to understand adversaries and apply advanced machine learning and engineering principles to defend the organization. Your work will significantly reduce the mean time to detect and respond to sophisticated cyber threats.

Responsibilities

• Proactively research, collect, and analyze threat intelligence from various sources to understand the current and emerging threat landscape.
• Design, implement, and maintain detection use cases for the entire machine learning lifecycle, including data ingestion, training, deployment, and inference.
• Produce and disseminate timely, relevant, and actionable intelligence reports and briefings for both technical security teams and executive leadership.
• Understanding of attacker Tools, Techniques and Procedures (TTPs)
• Understanding of attack components

Requirements

• Programming: Strong proficiency in at least one scripting/programming language for automation (e.g., Python)
• Security Concepts: Deep understanding of the cyber kill chain, threat actor TTPs, common attack vectors, networking protocols, and operating system internals
• Automation Expertise: Proven experience designing and implementing SOAR playbooks and integrating security tools via APIs
• Cloud Security: Familiarity with security services and automation in major cloud environments (AWS, Azure, or GCP)
• Experience: 4+ years of hands-on experience in a Security Engineering, Cyber Threat Intelligence, or Security Automation role
• Intelligence Tools: Experience working with commercial and open-source Threat Intelligence Platforms (TIPs) and threat feeds

Experience threat hunting in a complex network

• Experience validating vulnerability reports and providing impact analysis
• The ability to read an attack brief or vulnerability report and contextualize the associated risk
• Experience performing data gathering and analysis on perceived threats; generating additional contextual data that can be operationalized
• Experience with malware analysis and reverse engineering to extract actionable indicators
• Highly qualified candidates will have an understanding of nation state motivations and operational capabilities
• Ability to build partnerships and get results across many different stakeholders
• Ability to effectively communicate, both verbal and written, to stakeholders regarding relative risk, urgency, and feedback
• Ability to work autonomously with a strong sense of urgency, ownership and self drive
• Experience utilizing security event information in intelligence analysis
• Ability to navigate ambiguity, and provide clarity to complex situations
• Experience with common tools used within Security Operations

Preferred

• Familiarity with data analysis and visualization tools for threat intelligence
• Experience with Infrastructure-as-Code (IaC) tools like Terraform