Senior Threat Intelligence Engineer

A threat intelligence engineer on Cloudflare's Threat Detection Automation and Intelligence team, combining adversary research with machine learning and automation to cut the time it takes to detect and respond to attacks on Cloudflare. The role is based in Austin.

The engineer gathers intelligence from OSINT, commercial feeds, the dark web and internal events, profiles threat actors against MITRE ATT&CK, builds ML detection use cases end to end, engineers IOC and IOA ingestion and enrichment, writes SOAR playbooks and Python integrations across SIEM, EDR and CSPM tools, briefs leadership and supports incident response. Cloudflare wants four or more years in security engineering, threat intelligence or automation, strong Python, deep knowledge of attacker TTPs and the kill chain, SOAR and TIP experience, and cloud security familiarity.