Senior Incident Response Analyst - REACT

Available Locations: Lisbon, Portugal

About the Role

Cloudflare is a system spanning the globe, on a mission to make the Internet safer and more powerful every day. To help fulfill this mission, we are seeking an incident response Analyst / Consultant to join our Cloudforce One REACT organization.

In this role, you will respond to active customer attacks across two primary tracks:
1) L7 mitigations — bot abuse, web scraping, credential stuffing, and WAF/API abuse.
2) L3/L4 mitigations — volumetric and protocol DDoS attacks.

You will execute hands-on edge mitigations, verify effectiveness with measurable KPIs, and communicate clearly with customers under pressure. This position requires an innovative, self-starting, detail-oriented problem solver with a passion for scoping, deploying, and validating mitigations in real time. You will engage with customers at all levels — including Executive, VP, Director, and engineering, serving an integral role alongside forensic analysts, threat researchers, detection engineers, and malware analysts.

What You’ll Do

1. Active Edge Mitigation
• Deploy and tune custom WAF rules (block, challenge, JS challenge, managed challenge) to stop abusive L7 traffic.
• Implement bot mitigations using request/behavior signals and, where applicable, fingerprinting signals; apply rate limiting and challenge policies.
• Execute L3/L4 DDoS mitigations (e.g., attack mode tuning, shunning, flow-based controls) to protect customer availability before traffic reaches the origin.
• Scope every mitigation tightly by path, endpoint, tenant, or audience to minimize collateral impact.

2. Customer Containment & Threat Isolation
• Identify and isolate infected hosts, revoke compromised sessions/identities, and stop data exfiltration when needed.
• Track unauthorized lateral movement, correlate threat actor activity, and execute containment that preserves evidence while neutralizing the adversary.
• Adapt mitigations as attacker tactics change without over-scoping or breaking legitimate traffic.

3. Verification, KPIs & Rollback
• Define “mitigated” using success criteria: service health recovery, reduced abusive match rate, and acceptable collateral limits.
• Verify effectiveness after each mitigation update using time-bucketed telemetry; rollback or re-scope immediately if collateral damage appears.
• Maintain a versioning mindset for mitigations so updates are reversible and auditable.

4. IR Lifecycle, Evidence & Reporting
• Support the full incident response lifecycle: investigation, containment, remediation, and recovery.
• Preserve forensic evidence (logs, volatile memory, disk images) according to standards to support legal, regulatory, or insurance requirements.
• Prepare high-fidelity incident reports and customer communications that are clear, accurate, and actionable for both executives and engineers.

Minimum Qualifications (Must-Haves)
• 3+ years of hands-on experience in SOC, incident response, or detection engineering.
• Proven experience deploying mitigations that affect live customer traffic — not only monitoring or investigation.
• Hands-on with at least one of the following: WAF rules/actions, DDoS protection controls, bot mitigations, rate limiting/challenge policies.
• Strong incident process discipline: triage → scope → mitigate → verify → communicate.
• In-depth understanding of Windows operating systems and general knowledge of Unix/Linux/Mac environments.
• Familiarity with cloud environments (AWS, Azure, O365, Google Cloud) and cloud IR methodologies.
• Strong technical knowledge of common network protocols and design patterns (TCP/IP, HTTPS, SSH, RDP, SMB, DNS).
• Solid understanding of MITRE ATT&CK and the NIST Cybersecurity Framework.
• Excellent verbal and written English communication skills with a proven ability to establish relationships and clearly explain complex technical findings to executive and technical clients.

Desirable Skills, Knowledge, and Experience
• Experience with Cloudflare products (WAF, DDoS protection, Bot Management, API Shield) or equivalent edge platforms.
• Familiarity with bot fingerprinting concepts (e.g., JA3/JA4) and behavioral analysis.
• Proficient in Python or Golang; capable of writing modular code or simple scripts that can be used remotely.
• Familiarity with YARA and writing rules to detect similar malware samples.
• Practical malware analysis experience with static, dynamic, and automated techniques.
• Understanding of source code, hex, binary, regular expressions, data correlation, and analysis (network flow and system logs).
• Familiarity with bash command-line executables to conduct static analysis and investigate Indicators of Compromise (IOCs).
• Experience with network protocols and devices. (BGP, OSPF, Routers, Firewalls, Switches)

Compensation

● For Portugal based hires: Estimated annual salary is between €54,000 - €75,000.

• The final offer will be inclusive of time exemption, in alignment with the applicable law and collective bargaining agreements.

Equity

This role is eligible to participate in Cloudflare’s equity plan.