Response Engineer — Managed Defense Center

Cloudflare, Inc.; Greater London; Hybrid; GBP 70,000 - 105,000; Full time

Job summary

Cloudflare, Inc. is seeking a Response Engineer for the Cloudflare Managed Defense Center (CMDC) in London. This hybrid role focuses on autonomously investigating threat telemetry, handling live incident response for DDoS and application-layer attacks, and offering expert guidance to premium customers.

You will work closely with Web Application Security and DDoS mitigation teams, using dashboards and internal tools to propose precise mitigations while maintaining stable traffic delivery.

Qualifications

• 4–7 years of hands-on MDR or security operations experience.
• Experience with OWASP Top 10 vulnerabilities and WAF.
• Strong incident response and customer-facing communication skills.

Responsibilities

• Implement robust mitigation strategies for complex attacks using Cloudflare's suite (WAF, bot management, L7 rules, DDoS protection).
• Monitor alerts and perform near real-time traffic analysis to craft targeted mitigation rules.
• Review alerts for relevancy and urgency and respond proactively.
• Serve as the primary technical contact for customers during active incidents and coordinate with their engineering teams.
• Continuously tune monitoring rules to reduce false positives and improve signal-to-noise ratio.
• Lead onboarding sessions for customers and deliver technical security posture reviews and post-incident reports.
• Collaborate with internal engineering, product, and threat intel teams to feedback on trends and tooling gaps.

Skills

MDR

Security Operations

Incident Response

WAF

OWASP Top 10

Job description

Cloudflare, Inc. is seeking a Response Engineer for the Cloudflare Managed Defense Center (CMDC) in London. This hybrid role focuses on autonomously investigating threat telemetry, handling live incident response for DDoS and application-layer attacks, and offering expert guidance to premium customers.

You will work closely with Web Application Security and DDoS mitigation teams, using dashboards and internal tools to propose precise mitigations while maintaining stable traffic delivery.