Response Engineer - Cloudflare Managed Defense Center (CMDC)

The role

The Response Engineer acts as a primary technical responder for premium enterprise customers. You will investigate complex threat telemetry, handle live incident response for DDoS and application-layer attacks, and analyze traffic anomalies.

What you will do

• Implement mitigation strategies for complex attacks across OSI Layers 3, 4, and 7
• Monitor and investigate proactive alerts using packet and traffic flow analysis
• Review alerts to determine relevancy and urgency
• Proactively escalate customer-impacting incidents
• Act as the primary technical contact for customers during active security incidents
• Drive consultative communication with customers' technical engineering teams
• Tune and optimize security monitoring rules and alerting thresholds
• Lead managed customer onboarding sessions
• Maintain customer-specific runbooks
• Deliver technical monthly security posture reviews and post-incident reports

Required qualifications

• 4–7 years of direct, hands-on experience in Managed Detection and Response (MDR), advanced Security Operations, or high-level Technical Support/Incident Response for enterprise infrastructure
• Proven capability to handle both Application Security and Network Security
• Working knowledge of threat frameworks such as MITRE ATT&CK
• Operational understanding of internet protocols including TCP, UDP, ICMP, GRE, BGP, DNS
• Hands-on experience with packet capture or HTTP traffic inspection
• Extensive experience managing technical communications with enterprise customers during high-stress, active attacks
• Ability and willingness to work 24x7 rotating shifts

Nice to have

• Knowledge of industry security technologies (e.g., enterprise CDNs, cloud-based DDoS scrubbing centers, Next-Gen WAFs, and edge network firewalls)
• Proficiency in Linux/Unix environments and strong scripting skills (Bash, Python preferred)
• Experience leveraging agentic AI environments or LLMs to optimize operations
• Experience interacting with REST APIs or GraphQL
• Experience building or querying dashboards in Prometheus and Grafana
• Security and networking certifications such as GIAC (e.g., GCIA, GCIH, GCFA, GCFE), Cisco CCNA/CCNP, or equivalent hands-on incident response credentials

Before you apply

• Applicants who progress to the offer stage may be asked to attend an in-person interview within one of the Cloudflare Offices or Cloudflare Hubs
• This position may require access to information protected under U.S. export control laws
• Any offer of employment may be conditioned on your authorization to receive software or technology controlled under U.S. export laws without sponsorship for an export license

About the company

Cloudflare runs one of the world’s largest networks that powers millions of websites and other Internet properties. The company protects and accelerates any Internet application online.