Senior Incident Response Analyst (REACT)

About the role

Cloudflare is seeking a Senior Incident Response Analyst to join its REACT team in Lisbon. You will protect customers by responding to active attacks, handling both L7 (bot abuse, credential stuffing, API abuse) and L3/L4 (volumetric DDoS) threats. The role requires rapid, hands‑on mitigation and clear communication with stakeholders at all levels.

Key responsibilities

• Deploy and tune custom WAF rules, bot mitigation signals, and rate‑limiting policies to stop abusive L7 traffic.
• Execute L3/L4 DDoS mitigations, including attack‑mode tuning and flow‑based controls, to keep services available.
• Identify and isolate compromised hosts, revoke sessions, and prevent data exfiltration while preserving forensic evidence.
• Define success criteria, verify mitigation effectiveness with KPIs, and rollback or re‑scope actions if collateral impact occurs.
• Support the full incident response lifecycle—investigation, containment, remediation, and recovery—and produce detailed incident reports for executives and engineers.

Required profile

• 3+ years of hands‑on experience in a SOC, incident response, or detection engineering role.
• Proven ability to deploy mitigations that affect live customer traffic.
• Strong process discipline: triage → scope → mitigate → verify → communicate.
• Deep knowledge of Windows, Unix/Linux, and common network protocols.
• Familiarity with cloud environments (AWS, Azure, O365, Google Cloud) and standard frameworks such as MITRE ATT&CK and NIST CSF.

Required skills

• WAF rule configuration and DDoS protection controls.
• Bot mitigation techniques, including JA3/JA4 fingerprinting.
• Python and Golang scripting.
• YARA rule authoring and malware analysis (static and dynamic).
• Network protocol expertise (TCP/IP, HTTPS, SSH, RDP, SMB, DNS).
• Cloud platforms: AWS, Azure, O365, Google Cloud.

What we offer

• Annual salary €54,000 – €75,000, plus equity participation.
• Inclusive of time exemption in line with Portuguese law and collective agreements.