Incident Response Analyst - React

About the Role

Cloudflare is seeking a talented Incident Response Analyst to join the Cloudforce One REACT organization. You will be instrumental in building a proactive, threat intelligence-driven approach to protecting Cloudflare and its customers from sophisticated threat actors.

As a REACT Consultant, you will respond to security incidents across on-premises, cloud, and hybrid environments, engaging with stakeholders from engineering teams to executive leadership.

Responsibilities

Incident Response & Active Edge Mitigation

• Active Edge Mitigation: Execute defensive maneuvers at the Cloudflare edge, including deploying custom WAF rules, L3/L4 DDoS shunning, and real-time traffic filtering.
• Full IR Lifecycle Management: Support end-to-end incident response, including investigation, containment, remediation, and recovery.
• Incident Remediation: Develop and execute tactical and strategic remediation plans for compromised organizations.

Requirements

• Education: Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or equivalent experience.
• Experience: 5+ years in cybersecurity, with 2+ years of dedicated Incident Response.
• Technical Skills:
  • In-depth knowledge of Windows, Unix, Linux, and Mac environments.
  • Familiarity with cloud environments (AWS, Azure, O365, GCP, Cloudflare).
  • Strong understanding of L3/L4/L7 attack patterns (DDoS, credential stuffing, API abuse).
  • Proficiency with MITRE ATT&CK and NIST frameworks.
• Communication: Excellent verbal and written English skills; ability to explain complex technical findings to executive stakeholders.

Bonus Points

• Expertise in BGP, Anycast, DNS, and TCP/IP.
• Proficiency in Python or Golang.
• Experience with Yara, malware analysis, and reverse engineering.
• Familiarity with bash command-line tools for static analysis and IOC investigation.