Senior Incident Response Engineer: Edge & DDoS Mitigation

Cloudflare; United States; On-site; USD 62,000 - 87,000; Full time

Job summary

Cloudflare is seeking an incident response Analyst/Consultant to join the Cloudforce One REACT team. You will respond to active customer attacks, perform edge mitigations, and work with executives and engineers to contain threats and validate results.

The role emphasizes hands-on threat mitigation, threat containment, and clear communication under pressure. The position involves coordinating incident response across L7 and L3/L4 mitigations, maintaining evidence, and delivering high-fidelity

Qualifications

• 3+ years of hands-on experience in SOC, incident response, or detection engineering.
• Experience deploying mitigations that affect live customer traffic.
• Hands-on with WAF rules/actions, DDoS protection controls, bot mitigations, or rate-limiting/challenge policies.
• Strong incident process discipline: triage → scope → mitigate → verify → communicate.
• In-depth understanding of Windows and Unix/Linux/Mac environments.
• Familiarity with cloud environments (AWS, Azure, O365, Google Cloud).
• Strong knowledge of network protocols (TCP/IP, HTTPS, SSH, RDP, DNS).
• Familiarity with MITRE ATT&CK and the NIST Cybersecurity Framework.
• Excellent English communication skills.

Responsibilities

• Active Edge Mitigation: Deploy and tune WAF rules to stop abusive L7 traffic.
• Customer Containment & Threat Isolation: Identify infected hosts and stop data exfiltration.
• Verification, KPIs & Rollback: Define mitigated criteria and verify with telemetry.
• IR Lifecycle, Evidence & Reporting: Support investigation, containment, remediation, and recovery.

Skills

SOC experience

IR incident response

WAF/DDoS mitigations

Cloud environments

Networking protocols

MITRE ATT&CK & NIST

English communication

Tools

Python

Golang

JA3/JA4

YARA

Job description

Cloudflare is seeking an incident response Analyst/Consultant to join the Cloudforce One REACT team. You will respond to active customer attacks, perform edge mitigations, and work with executives and engineers to contain threats and validate results.

The role emphasizes hands-on threat mitigation, threat containment, and clear communication under pressure. The position involves coordinating incident response across L7 and L3/L4 mitigations, maintaining evidence, and delivering high-fidelity