Incident Response Analyst - REACT

Available Locations: Lisbon, Portugal 

About the Role

Cloudflare is a system spanning the globe, on a mission to make the Internet safer and more powerful every day. To help fulfill this mission, we are seeking an incident response Analyst / Consultant to join our Cloudforce One REACT organization.

In this role, you will respond to active customer attacks across two primary tracks:
1) L7 mitigations — bot abuse, web scraping, credential stuffing, and WAF/API abuse.
2) L3/L4 mitigations — volumetric and protocol DDoS attacks.

You will execute hands-on edge mitigations, verify effectiveness with measurable KPIs, and communicate clearly with customers under pressure. This position requires an innovative, self-starting, detail-oriented problem solver with a passion for scoping, deploying, and validating mitigations in real time. You will engage with customers at all levels — including Executive, VP, Director, and engineering, serving an integral role alongside forensic analysts, threat researchers, detection engineers, and malware analysts.

What You’ll Do

1. Active Edge Mitigation
   • Deploy and tune custom WAF rules (block, challenge, JS challenge, managed challenge) to stop abusive L7 traffic.
   • Implement bot mitigations using request/behavior signals and, where applicable, fingerprinting signals; apply rate limiting and challenge policies.
   • Execute L3/L4 DDoS mitigations (e.g., attack mode tuning, shunning, flow-based controls) to protect customer availability before traffic reaches the origin.
   • Scope every mitigation tightly by path, endpoint, tenant, or audience to minimize collateral impact.

2. Customer Containment & Threat Isolation
   • Identify and isolate infected hosts, revoke compromised sessions/identities, and stop data exfiltration when needed.
   • Track unauthorized lateral movement, correlate threat actor activity, and execute containment that preserves evidence while neutralizing the adversary.
   • Adapt mitigations as attacker tactics change without over-scoping or breaking legitimate traffic.

3. Verification, KPIs & Rollback
   • Define “mitigated” using success criteria: service health recovery, reduced abusive match rate, and acceptable collateral limits.
   • Verify effectiveness after each mitigation update using time-bucketed telemetry; rollback or re-scope immediately if collateral damage appears.
   • Maintain a versioning mindset for mitigations so updates are reversible and auditable.

4. IR Lifecycle, Evidence & Reporting
   • Support the full incident response lifecycle: investigation, containment, remediation, and recovery.
   • Preserve forensic evidence (logs, volatile memory, disk images) according to standards to support legal, regulatory, or insurance requirements.
   • Prepare high-fidelity incident reports and customer communications that are clear, accurate, and actionable for both executives and engineers.

Minimum Qualifications (Must-Haves)
   • 3+ years of hands-on experience in SOC, incident response, or detection engineering.
   • Proven experience deploying mitigations that affect live customer traffic — not only monitoring or investigation.
   • Hands-on with at least one of the following: WAF rules/actions, DDoS protection controls, bot mitigations, rate limiting/challenge policies.
   • Strong incident process discipline: triage → scope → mitigate → verify → communicate.
   • In-depth understanding of Windows operating systems and general knowledge of Unix/Linux/Mac environments.
   • Familiarity with cloud environments (AWS, Azure, O365, Google Cloud) and cloud IR methodologies.
   • Strong technical knowledge of common network protocols and design patterns (TCP/IP, HTTPS, SSH, RDP, SMB, DNS).
   • Solid understanding of MITRE ATT&CK and the NIST Cybersecurity Framework.
   • Excellent verbal and written English communication skills with a proven ability to establish relationships and clearly explain complex technical findings to executive and technical clients.

Desirable Skills, Knowledge, and Experience
   • Experience with Cloudflare products (WAF, DDoS protection, Bot Management, API Shield) or equivalent edge platforms.
   • Familiarity with bot fingerprinting concepts (e.g., JA3/JA4) and behavioral analysis.
   • Proficient in Python or Golang; capable of writing modular code or simple scripts that can be used remotely.
   • Familiarity with YARA and writing rules to detect similar malware samples.
   • Practical malware analysis experience with static, dynamic, and automated techniques.
   • Understanding of source code, hex, binary, regular expressions, data correlation, and analysis (network flow and system logs).
   • Familiarity with bash command-line executables to conduct static analysis and investigate Indicators of Compromise (IOCs).
   • Experience with network protocols and devices.  (BGP, OSPF, Routers, Firewalls, Switches)

 

Compensation

● For Portugal based hires: Estimated annual salary is between €54,000 - €75,000.

• The final offer will be inclusive of time exemption, in alignment with the applicable law and collective bargaining agreements.

Equity

This role is eligible to participate in Cloudflare’s equity plan.