Senior Threat Intelligence Engineer

Written by the T&S Network from Cloudflare's posting.

Threat intelligence and detection engineering on Cloudflare's internal security team, the Threat Detection Automation and Intelligence Team. The role turns threat data about adversaries targeting Cloudflare into detection use cases, automated defenses and SOAR playbooks, with machine learning applied to detection. The team's aim is to cut mean time to detect and mean time to respond to sophisticated cyber threats.

What you'd do

• Research and analyze threat intelligence from OSINT, commercial feeds, dark web and internal security events.
• Design, build and maintain machine learning detection use cases across ingestion, training, deployment and inference.
• Profile relevant threat actors and their TTPs using MITRE ATT&CK, and assess impact to the organization.
• Write actionable intelligence reports and briefings for technical teams and executive leadership.
• Engineer ingestion, enrichment and correlation of IOCs and IOAs into security platforms.
• Build SOAR automation for triage, alert enrichment, vulnerability management and threat response.

What it asks for

• Four or more years working in security engineering, threat intelligence or security automation.
• Strong proficiency in at least one scripting or programming language for automation, such as Python.
• Deep understanding of the kill chain, threat actor TTPs, attack vectors, networking protocols and OS internals.
• Proven experience designing SOAR playbooks and integrating security tools through APIs.

Worth knowing

• Position may require access to information controlled under U.S. export control laws.
• Offer may be conditioned on export license authorization without sponsorship.

Terms in this role

OSINT.

Open-source intelligence: investigating with publicly available information, such as social media, public records, archived pages and imagery.

Our best summary of the posting, and it can be wrong. The employer's posting is what counts: read it in full on Cloudflarenorth_east before you apply. If we got something wrong, report this listing.