24/7 Incident Response Engineer – Enterprise Security

Cloudflare; Greater London; On-site; GBP 90,000 - 130,000; Full time

Job summary

Cloudflare in London, United Kingdom, is seeking an experienced Response Engineer for our Managed Defense Center. You will autonomously investigate threat telemetry, handle live incident responses for DDoS and application-layer attacks, and analyze traffic anomalies during high-pressure events.

Join a team focused on WAF, Bot Management, and DDoS mitigation, delivering proactive monitoring and expert guidance to enterprise customers.

Qualifications

• 4–7 years of hands-on experience in MDR, incident response, or enterprise security operations.
• Experience handling both application and network security incident response.
• Familiarity with threat frameworks (MITRE ATT&CK) and security tooling.

Responsibilities

• Implement robust mitigation strategies for complex attacks across OSI Layers 3–7 using Cloudflare’s suite.
• Monitor proactive alerts and perform near real-time traffic analysis to detect and mitigate threats.
• Review alerts, escalate customer-impacting incidents, and maintain SLA-aligned communications.
• Act as the primary technical contact for customers during active incidents, coordinating with engineering teams.
• Tune security monitoring rules and alerts to improve signal-to-noise and reduce false positives.
• Lead managed customer onboarding sessions and deliver technical security posture reviews.
• Collaborate with internal teams to provide feedback on attack trends and product improvements.

Skills

MDR experience

Incident response

Threat intelligence

Linux scripting

Tools

tcpdump

Wireshark

tshark

REST APIs

GraphQL

Job description

Cloudflare in London, United Kingdom, is seeking an experienced Response Engineer for our Managed Defense Center. You will autonomously investigate threat telemetry, handle live incident responses for DDoS and application-layer attacks, and analyze traffic anomalies during high-pressure events.

Join a team focused on WAF, Bot Management, and DDoS mitigation, delivering proactive monitoring and expert guidance to enterprise customers.