Web Security & Detection Researcher: Adversary Detection

Webhosting; Northern, New York (KY, NY); On-site; USD 150,000 - 230,000; Full time

Benefits offered by this job

Time Off

Job summary

Cloudflare is looking for a security-focused professional to join the Detection team in New York, helping identify automated, fraudulent, and malicious activity across the Internet. You will develop signals and detections, collaborating with data scientists and engineers to keep customers safe at scale.

You’ll work to translate attacker behavior into concrete defenses, reverse-engineer fraud kits, and design mitigations that don’t reveal defensive signals.

Qualifications

• You know our adversaries, understand bots, automation, and the tooling used to attack web applications at scale.
• You enjoy ethical hacking and reverse engineering, with an adversarial mindset that assumes every defense can be broken.
• Translate what you learn about attackers into concrete signals defenders can use.
• Explain complex attacker behavior to technical and non-technical audiences alike.

Responsibilities

• Study adversaries and reverse-engineer bot tools and fraud kits to understand how they work and evolve.
• Probe our detections like an attacker to close gaps and stay ahead as attackers adapt.
• Track bot and fraud ecosystems and turn intelligence into detection signals.
• Develop heuristics, signatures, and detection ideas grounded in attacker behavior.
• Design mitigations that neutralize attackers while preserving signals.
• Automate manual investigations and rule-writing into scalable detection.

Skills

Bots & web app attack knowledge

Ethical hacking

Reverse engineering

Communication skills

Tools

Attack tooling knowledge

Job description

Cloudflare is looking for a security-focused professional to join the Detection team in New York, helping identify automated, fraudulent, and malicious activity across the Internet. You will develop signals and detections, collaborating with data scientists and engineers to keep customers safe at scale.

You’ll work to translate attacker behavior into concrete defenses, reverse-engineer fraud kits, and design mitigations that don’t reveal defensive signals.