Senior Response Engineer - Cloudflare Managed Defense Center (CMDC)

Job Summary

As a Senior Response Engineer within the Cloudflare Managed Defense Center (CMDC), you will serve as a subject-matter expert and technical escalation point for threat mitigation across Cloudflare's strategic enterprise customer base.

In this role, you will lead the response to sophisticated, multi-vector cyberattacks spanning OSI Layers 3, 4, and 7, operating beyond standard playbooks to diagnose anomalies, engineer custom mitigations, and stabilize mission-critical infrastructure under fire.

Beyond active incident command, you will act as a force multiplier: architecting customer-specific defense strategies, authoring and refining automated detection logic, mentoring Tier 1 and Tier 2 engineers, and collaborating directly with Cloudflare Product and Engineering teams.

Responsibilities

• Act as the technical lead and incident commander during high-impact, multi-vector security events, designing and deploying bespoke mitigation strategies when standard runbooks do not suffice.
• Perform deep-dive forensic analysis into complex Layer 3/4 and Layer 7 traffic anomalies, identifying zero-day attack patterns, sophisticated bot networks, and novel evasion techniques.
• Apply advanced mitigation strategies and filter malicious traffic using Cloudflare's core security suite, including Magic Transit, Web Application Firewall (WAF), and Advanced Rate Limiting.
• Lead technical communications and incident bridge calls with enterprise C-level executives, principal network engineers, and security teams during critical events, clearly articulating root causes, impact assessments, and remediation paths.
• Monitor and investigate proactive security alerts across internal telemetry systems to rapidly triage incoming events, assess blast radius, and validate threat severity.
• Adhere to and champion strict customer SLAs for alert response times, event analysis, and clear executive reporting.
• Mentor and elevate Tier 1 and Tier 2 engineers through structured shadowing, technical post-mortems, and internal training.
• Partner with internal Engineering and Product teams to translate operational attack trends into prioritized platform enhancements, tool feedback, and automated detection logic.

Requirements

• A minimum of 6–8 years of hands-on experience in a high-volume Security Operations Center (SOC), Managed Detection and Response (MDR), network engineering, or incident response environment dealing directly with live threat mitigation.
• Comprehensive knowledge of networking principles and internet infrastructure, including TCP/IP, UDP, ICMP, DNS, BGP routing mechanics, and edge network design.
• Deep expertise in Layer 7 protocols and web architectures (HTTP/1.1, HTTP/2, HTTP/3, TLS handshakes/ciphers, reverse proxy models, and API security).
• Experience analyzing network traffic data for anomaly detection and designing, tuning, and executing advanced mitigation strategies against L3/L4 and L7 attacks, including bespoke countermeasures when standard playbooks are insufficient.
• Advanced proficiency in packet capture and network traffic analysis using tools such as tcpdump, Wireshark, or tshark to isolate anomalies and dissect malformed or novel payloads.
• Practical experience analyzing and mitigating security incidents using AI and machine learning tools, paired with the hands-on capability to build and integrate custom tooling that improves operational workflows, accelerates log telemetry analysis, and defends against AI-driven botnets and adversarial edge attacks.
• Proficiency in using the command line (Bash shell) alongside general system administration literacy across Linux, Mac, or Windows environments.
• Proven experience commanding incident bridges, making decisive risk-tradeoff decisions, and maintaining composure while managing enterprise stakeholders during high-pressure crises.