Senior Threat Intelligence & Automation Engineer

Cloudflare; Austin (TX); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

Equity plan

Health insurance

401(k)

Job summary

Cloudflare is seeking an experienced Threat Intelligence Engineer to join the Threat Detection Automation and Intelligence Team in Austin. You will transform raw threat data into actionable defenses and automate complex security operations to reduce MTTD and MTTR.

Responsibilities include researching threat intel from multiple sources, designing ML-based detection, profiling threat actors using MITRE ATT&CK, and integrating IOC/IOA data with security tools through APIs and SOAR playbooks.

Qualifications

• 4+ years in Security Engineering, Cyber Threat Intelligence, or Security Automation.
• Proficiency with Python or similar scripting language.
• Experience with MITRE ATT&CK and TTPs.

Responsibilities

• Proactively research and analyze threat intelligence from OSINT, commercial feeds, dark web, and internal events.
• Design, implement, and maintain detection use cases across the ML lifecycle.
• Develop threat actor profiles and operationalize IOC/IOA data into security platforms.
• Create SOAR playbooks and automate security workflows for incident triage and response.
• Collaborate with Detection Engineers, Security Engineers, and Developers to integrate security into CI/CD.

Skills

Threat intelligence

Machine learning

Python

Security tooling

Automation

SOAR

Incident response

Threat hunting

Education

BS in CS/IS/CI or related

Tools

SIEM

EDR

Threat intel platforms

Terraform

Job description

Cloudflare is seeking an experienced Threat Intelligence Engineer to join the Threat Detection Automation and Intelligence Team in Austin. You will transform raw threat data into actionable defenses and automate complex security operations to reduce MTTD and MTTR.

Responsibilities include researching threat intel from multiple sources, designing ML-based detection, profiling threat actors using MITRE ATT&CK, and integrating IOC/IOA data with security tools through APIs and SOAR playbooks.