Cloudflare
Senior Threat Intelligence Engineer
Hybrid +1 · Senior · Full-time · Posted Jan 22, 2026
- Location
- Hybrid
Austin, TX, United States - Experience
- 4+ years of hands-on experience in a Security Engineering, Cyber Threat Intelligence, or Security Automation role.
- Visa sponsorship
- Any offer may be conditioned on authorization to receive software or technology controlled under U.S. export laws without sponsorship for an export license.
About the job
Develop threat intelligence and machine-learning-driven detection and automation to help Cloudflare identify, investigate, and respond to cyber threats.
What you'll do
- Collect and analyze threat data, profile threat actors and disseminate actionable intelligence.
- Build machine-learning detection use cases across the lifecycle and manage IOC/IOA ingestion and enrichment.
- Develop SOAR workflows and integrate security tools to automate operations and support incident response.
What they ask for
- 4+ years of hands-on experience in a Security Engineering, Cyber Threat Intelligence, or Security Automation role.
- Strong proficiency in at least one scripting/programming language for automation (e.g., Python).
- Deep understanding of the cyber kill chain, threat actor TTPs, common attack vectors, networking protocols, and operating system internals.
- Proven experience designing and implementing SOAR playbooks and integrating security tools via APIs; experience with commercial and open-source Threat Intelligence Platforms (TIPs) and threat feeds.
Nice to have
- Experience threat hunting in a complex network; malware analysis and reverse engineering; or validating vulnerability reports and assessing impact.
- Experience with Infrastructure-as-Code tools like Terraform and data analysis or visualization tools for threat intelligence.
Tools
MITRE ATT&CK, Python, SOAR, SIEM, EDR, Terraform, AWS, Azure
AI focus
Design, implement, and maintain machine-learning detection use cases across data ingestion, training, deployment, and inference.
Model-written summary · the original posting is authoritative