Responsibilities
- examine and mitigate threats in real-time, leveraging emerging technologies to build detections that protect millions of people from various forms of attacks and abuse.
- identify Tactics, Techniques, and Procedures (TTPs) of ongoing and ever-evolving cyber attacks to protect our global customer base.
- work in close collaboration with team members to develop new and innovative ways to present and interact with our unique insights.
Requirements
- Experience in one of the following: Data analysis, Metadata analysis, or Network Traffic analysis.
- A passion for analyzing attacker TTPs at varying levels.
- Ability to understand the latest security trends as they relate to platform threats and abuse.
- Experience using a comprehensive data analysis platform and rule configuration.
- Understanding of the cyber threat landscape, cyber intelligence, and working knowledge of threat actors and their techniques.
- Experience tracking and analyzing cyber campaigns utilizing technical Indicators of Compromise (IOCs).
- Working knowledge of SQL and devising SQL queries.
- Python or other scripting experience.
- Ability to synthesize technical information and document it in a non-technical manner through both graphical and verbal representation.
- Capable and comfortable communicating actionable threat intelligence to both technical and executive-level stakeholders.
- Great oral and written communications skills.
- Desire to learn and improve.
- Willing and eager to share knowledge, and mentor.
Nice to Have
- Working knowledge of a specific platform or product's authentication protocols (e.g., email, network, application) and experience in related header/log analysis.
- Experience analyzing, tracking and defending against various types of cyber attacks, including phishing, malware, and abuse.
- Strong understanding of the cyber threat landscape, with expertise in advanced persistent threat (APT) groups.
- Working knowledge of OSI Layers.
- Working knowledge of TCP/UDP/ICMP, DNS, HTTP/HTTPS, SMTP/SMTPS, SSH/SFTP/SCP, FTP.
- Familiarity with regular expressions and their practical application in tracking malicious activity.
- Vibe coding experience for building tools and applications.
- Experience with detection development using YARA, Snort, Surricata, or an equivalent language.
- BS in Computer Science, Information Technology, Information Security, Computer Security or Information Systems.
Team
Structure: Cloudforce One is Cloudflare’s threat operations and research team, responsible for identifying and disrupting cyber threats ranging from sophisticated cyber criminal activity to nation-state sponsored advanced persistent threats (APTs).
