Senior Threat Intelligence Engineer

Cloudflare

Senior Threat Intelligence Engineer leveraging Threat Intelligence and Machine Learning to defend Cloudflare from threats. Collaborating with security teams for proactive threat detection and response.

Posted 6/17/2026full-timeAustin • Texas • 🇺🇸 United StatesSeniorWebsite

Tech Stack

Tools & technologies

AWSAzureCloudGoogle Cloud PlatformPython

About the role

Key responsibilities & impact

Proactively research, collect, and analyze threat intelligence from various sources (OSINT, commercial feeds, dark web, and internal security events) to understand the current and emerging threat landscape.
Design, implement, and maintain detection use cases for the entire machine learning lifecycle (data ingestion, training, deployment, and inference).
Develop detailed profiles of relevant threat actors, their Tactics, Techniques, and Procedures (TTPs) using frameworks like MITRE ATT&CK, and identify potential impacts to the organization.
Produce and disseminate timely, relevant, and actionable intelligence reports and briefings for both technical security teams and executive leadership.
Engineer the ingestion, enrichment, correlation, and contextualization of Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) into security platforms.
Design, develop, and implement robust automation workflows and playbooks (SOAR) to streamline security operations tasks, including incident triage, alert enrichment, vulnerability management, and threat response actions.
Integrate diverse security tools (e.g., SIEM, EDR, Cloud Security Posture Management, vulnerability scanners, Threat Intelligence Platforms) through APIs and scripting (primarily Python) to create seamless, automated feedback loops.
Identify manual, repetitive, and time-consuming security processes and engineer scalable automation solutions to increase team efficiency and operational maturity.
Provide threat context to support the Incident Response team during active security incidents.
Collaborate with Detection Engineers, Security Engineers, and Software Developers to embed security and intelligence-driven practices into the CI/CD pipeline and corporate infrastructure.

Requirements

What you’ll need

4+ years of hands-on experience in a Security Engineering, Cyber Threat Intelligence, or Security Automation role.
Strong proficiency in at least one scripting/programming language for automation (e.g., Python).
Deep understanding of the cyber kill chain, threat actor TTPs, common attack vectors, networking protocols, and operating system internals.
Proven experience designing and implementing SOAR playbooks and integrating security tools via APIs.
Experience working with commercial and open-source Threat Intelligence Platforms (TIPs) and threat feeds.
Familiarity with security services and automation in major cloud environments (AWS, Azure, or GCP).

Benefits

Comp & perks

Health insurance
401(k) matching
Flexible work hours
Paid time off
Professional development opportunities

ATS Keywords

✓ Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills & Tools

threat intelligence analysismachine learning lifecycleautomation workflowsscriptingPythonSOAR playbooksAPI integrationIndicators of Compromise (IOCs)Indicators of Attack (IOAs)networking protocols

Soft Skills

collaborationcommunicationproactive researchanalytical thinkingreportingproblem-solvingteam efficiencyoperational maturity