About the company
Cloudflare is a system spanning the globe, on a mission to make the internet safer and more powerful everyday.
Responsibilities
- Execute immediate defensive maneuvers at the Cloudflare edge to protect customer availability, including deploying custom WAF rules, implementing L3/L4 DDoS shunning, and performing real-time traffic filtering.
- Support and execute the end-to-end incident response process for clients (investigation, containment, remediation, and recovery).
- Review technical deliverables and coordinate sessions with customer stakeholders.
- Build a strong understanding of targeted attacks to create and execute customized tactical and strategic remediation plans for compromised organizations.
Requirements
- Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or equivalent experience.
- 5+ years of overall experience in cybersecurity, including 2+ years of dedicated Incident Response.
- In-depth understanding of Windows operating systems and general knowledge of Unix, Linux, and Mac environments.
- Familiarity with cloud environments (AWS, Azure, O365, Google Cloud, Cloudflare) and cloud IR methodologies.
- Strong understanding of common L3/L4/L7 attack patterns, including SYN floods, UDP floods, DNS amplification, HTTP floods, credential stuffing, scraping, API abuse, account enumeration, and checkout abuse.
- Experience with JA3/JA4 fingerprinting, bot detection, behavioral traffic analysis, or API abuse investigations.
- Solid understanding of MITRE ATT&CK and NIST Cyber Security Frameworks.
- English fluency, excellent verbal and written communication skills.
Bonus points
- Strong understanding of internet routing fundamentals, including BGP, Anycast, DNS, TCP/IP, GRE/IPsec tunneling, RPKI, IRR, ASN ownership.
- Proficient in Python or Golang.
- Proficient with Yara and writing rules to detect malware samples.
- Practical malware analysis experience with static, dynamic, and automated techniques.
- Reverse engineering experience with APT malware.