Senior Response Engineer - Cloudflare Managed Defense Center (CMDC)

The Senior Response Engineer (Network Security focused) within the Cloudflare Managed Defense Center (CMDC) serves as a core technical specialist within the proactive security team. This position is built for a network security practitioner who thrives at the intersection of deep routing protocol investigation, edge-network defense, and strategic technical partnership. The role is responsible for architecting responses to sophisticated infrastructure threats across OSI Layers 3, 4, and 7, ensuring global customers remain resilient against large-scale volumetric DDoS attacks and complex network-layer anomalies.

Acting as a primary technical anchor for network defense, you will provide advanced assistance and strategic intelligence across Cloudflare’s most sophisticated customer environments. This involves deep mastery of infrastructure protection components (spanning Cloudflare’s native services or industry-equivalent solutions), including BGP routing and advertisement control (managing prefix advertisement and de-advertisement), network protection like Magic Transit, IPFLOW-based Magic Network Monitoring, Advanced TCP/UDP protection, DDoS mitigation rulesets, firewall configurations, Layer 4 proxies such as Spectrum, DNS Firewall, and connectivity troubleshooting over GRE, IPsec, and CNI. A working knowledge of application security (including CDN technology and Web Application Firewalls) will allow you to extend support across broader Managed Defense activities.

The role focuses on:

• Technical Mentorship: Elevating the team’s collective skill set by acting as a "player-coach" providing hands-on technical guidance during live incidents and reviewing complex mitigation strategies.
• Deep-Dive Investigation & Mitigation: Analyzing infrastructure threats using advanced internal telemetry to engineer informed mitigation strategies—specifically focusing on DDoS vectors, BGP routing anomalies, and GRE encapsulation issues—implementing defenses directly on the edge for mission-critical traffic.
• Detection Engineering & Tuning: Continuously designing and refining detection mechanisms, security controls, and alerting thresholds to ensure highly accurate, rapid identification of sophisticated network attacks with minimal false positives.
• Infrastructure & Tooling Evolution (AI-Driven): Partnering closely with Product, Engineering, and AI teams to transform real-world DDoS attack data into AI-powered automated network defenses, dynamic mitigation models, and enhanced platform capabilities.
• Strategic Technical Communication: Serving as an authoritative technical voice during active volumetric attacks, providing clarity and architectural routing guidance to both internal stakeholders and external customer engineering teams.

The ideal candidate moves beyond following static runbooks to engineering AI-assisted response workflows, transforming raw network flow telemetry into actionable mitigation strategies, tuned detections, and intelligent, automated edge defenses.

• Technical Escalation & Response: Acting as a subject matter expert for the Managed Defense Center during complex network security incidents, providing hands-on intervention for large-scale volumetric and protocol-based DDoS attacks when standard protocols are exceeded.
• Incident Architecture: Leading the technical response to sophisticated infrastructure threats, validating the efficacy of network mitigation rules, and ensuring stable, clean traffic delivery via BGP and GRE mechanisms.
• Detection Engineering: Designing, deploying, and tuning network attack detection logic, utilizing attack telemetry to stay consistently ahead of evolving DDoS methodologies and adversary tactics.
• Technical Communications: Driving high-touch technical dialogue with customer network teams during critical incidents, translating complex routing and attack flow data into actionable architectural advice.
• Operational Engineering & AI Integration: Designing and refining technical Managed Defense workflows, building AI-driven automated troubleshooting playbooks (particularly around BGP/GRE), and tuning alerting thresholds to create self-healing infrastructure responses.
• Forensics & Analysis: Utilizing internal telemetry, flow data, and specialized monitoring tools to perform deep-dive forensics on novel network attack vectors.
• Technical Coaching: Mentoring the Managed Defense team on advanced traffic analysis and security best practices, ensuring a high technical bar across the Managed Defense Center.