Latest AI JobsBrowse Jobs
Cloudflare logo

Senior Threat Intelligence Engineer

CloudflareHybridSecurity
Apply on company site
Salary
Not listed
Job type
Full-time
Posted
22 Jan 2026
Status
Open · checked 7d ago

About this role

The Senior Threat Intelligence Engineer at Cloudflare is an exciting hybrid opportunity focused on blending threat intelligence with machine learning and engineering principles. This role suits a proactive security professional looking to protect a massive global network and reduce detection and response times against cyber threats.

Role Overview

Cloudflare is seeking an experienced Senior Threat Intelligence Engineer to join its proactive security team within the Threat Detection Automation and Intelligence Team. This position operates on a hybrid schedule, with available locations including Austin, US. The primary focus of the role is transforming raw threat data into actionable security measures and automated defenses, significantly reducing detection and response times to sophisticated cyber threats using machine learning and data science.

Key Responsibilities

Proactively research, collect, and analyze threat intelligence from OSINT, commercial feeds, the dark web, and internal security events to understand the emerging threat landscape.
Design, implement, and maintain detection use cases spanning the entire machine learning lifecycle, including data ingestion, training, deployment, and inference.
Build detailed profiles of relevant threat actors and their Tactics, Techniques, and Procedures using frameworks like MITRE ATT&CK.
Produce and disseminate timely intelligence reports and briefings for technical security teams and executive leadership.
Engineer the ingestion, enrichment, correlation, and contextualization of Indicators of Compromise and Indicators of Attack into security platforms.
Design and implement robust automation workflows and playbooks using SOAR to streamline security operations tasks.
Integrate diverse security tools via APIs and scripting to create seamless, automated feedback loops.
Collaborate with Detection Engineers, Security Engineers, and Software Developers to embed intelligence-driven practices into the CI/CD pipeline.

Requirements

4+ years of hands-on experience in a Security Engineering, Cyber Threat Intelligence, or Security Automation role.
Strong proficiency in at least one scripting or programming language for automation, such as Python.
Deep understanding of the cyber kill chain, threat actor TTPs, common attack vectors, networking protocols, and operating system internals.
Proven experience designing and implementing SOAR playbooks and integrating security tools via APIs.
Experience working with commercial and open-source Threat Intelligence Platforms and threat feeds.
Familiarity with security services and automation in major cloud environments like AWS, Azure, or GCP.

Nice to Have

Understanding of attacker TTPs, attack components, and nation-state motivations and operational capabilities.
Experience threat hunting in complex networks, reading attack briefs, validating vulnerability reports, and performing data gathering and analysis.
Experience with common security operations tools, security event information analysis, malware analysis, and reverse engineering.
Familiarity with Infrastructure-as-Code tools such as Terraform, as well as data analysis and visualization tools for threat intelligence.
Ability to navigate ambiguity, work autonomously with a strong sense of urgency, and communicate relative risk effectively.

Skills and Tools

Python
AWS, GCP, Azure
Terraform
SOAR playbooks and APIs
Threat Intelligence Platforms and Feeds
SIEM, EDR, and vulnerability scanners

Salary and Benefits

Medical, dental, and vision insurance with flexible and commuter spending accounts
Fertility and family-forming benefits, alongside on-demand mental health support and an Employee Assistance Program
Global travel medical insurance, short and long-term disability insurance, and life and accident insurance
401(k) retirement savings plan and an Employee Stock Participation plan
Flexible paid time off covering vacation and sick leave, plus parental, pregnancy health, medical, and bereavement leave
Eligibility to participate in Cloudflare’s equity plan

About the Company

Cloudflare runs one of the world's largest networks powering millions of internet properties, helping build a better and more secure internet. The company is recognized for its unique culture and impactful initiatives like Project Galileo, which protects journalism and civil society organizations, and the Athenian Project, which defends state and local government election websites at no cost.

How to Apply

Interested candidates should visit the official Cloudflare careers page to submit their application.

Skills and tech stack

PythonAWSGCPAzureTerraform

Questions candidates ask

What experience is required for the Senior Threat Intelligence Engineer role?

Candidates must have at least 4 years of hands-on experience in a Security Engineering, Cyber Threat Intelligence, or Security Automation role.

What programming languages and tools are needed?

Strong proficiency in Python is required, along with experience using AWS, GCP, or Azure, Terraform, SOAR playbooks, APIs, and various Threat Intelligence Platforms.

Is this position remote?

This is a hybrid position with available locations including Austin, US.

What benefits does Cloudflare offer employees in the United States?

Cloudflare provides medical, dental, and vision insurance, flexible spending accounts, 401(k) retirement savings, an employee stock participation plan, flexible paid time off, parental leave, and equity plan participation.

What are the primary responsibilities of the role?

Responsibilities include collecting and analyzing threat intelligence, designing machine learning detection use cases, profiling threat actors, managing IOCs and IOAs, and developing automated defense workflows.

Ready to apply?

The application is on the official Cloudflare careers page.

Apply on company site