# Response Engineer

**Company:** [Cloudflare](https://hotfix.jobs/companies/cloudflare)
**Location:** Unspecified
**Role:** Support Engineering
**Experience:** 5+ years
**Skills:** Spf, Dkim, Dmarc, Bec, Phishing Analysis, Threat Hunting, Email Security, Llm Tools, Yara, SQL, Regular Expressions, Malware Analysis
**Posted:** 2026-07-01

> Response Engineer for PhishGuard on Cloudflare's Cloudforce One team. Monitor email threat queues, investigate BEC/phishing attacks, perform threat hunts, provide customer notifications and onboarding, and feed insights to ML detection models. Requires 5+ years in cyber threat analysis with deep email protocol expertise.

## Job Description

## Role Responsibilities
- Conduct continuous, real-time monitoring of email threat queues to review and analyze sophisticated attacks flagged by Cloudflare Email Security automated systems.
- Investigate customer-reported submissions, execute proactive threat hunts targeting emerging patterns, and perform manual retraction or quarantine of verified malicious emails.
- Provide critical feedback to Detection Engineering to update machine learning models and contribute novel campaign data to global intelligence repositories.
- Identify nuanced threat patterns by correlating technical telemetry with behavioral indicators, generating detailed threat dossiers for impending organizational risks.
- Deliver direct crisis intervention and proactive phone notifications to customers regarding high-dollar BEC threats and active insider risks.
- Lead technical onboarding sessions for new customers, configuring internal system instances with bespoke detection rules, thresholds, and custom allow/block lists.
- Guide customers through their multi-year DMARC implementation journey toward strict "Reject" policy enforcement by conducting SPF and DKIM alignment audits.

## Role Requirements (Must-Have Skills)
- Undergraduate degree in Computer Science, Information Security, Information Systems, or equivalent practical experience.
- 5+ years of experience tracking and analyzing complex cyber campaigns utilizing technical indicators such as Domains, IP Addresses, and email headers.
- Proven expertise analyzing, investigating, and defending against highly targeted phishing, invoice fraud, and Business Email Compromise (BEC) attacks.
- Deep working knowledge of core email authentication protocols (SPF, DKIM, DMARC) and aggregate/forensic data interpretation.
- Hands-on experience utilizing AI LLM tools (such as OpenCode or Windsurf) to develop automations for daily analysis and productivity workflows.
- Excellent verbal and written English communication skills, with a strong ability to translate complex technical threats into actionable business intelligence for executive stakeholders.

## Nice-to-Have Skills
- Relevant industry certifications such as GCIH, GCIA, CEH, Security+, or equivalent.
- Technical familiarity with regular expressions, YARA rules, SQL query formulation, and malicious file format analysis (e.g., Microsoft Office Documents, Adobe PDFs).
- Prior experience working within managed security services (MSSP) or customer-facing security consulting environments.
- Familiarity with the broader Cloudflare ecosystem, including Cloudflare Email Security, WAF, and Zero Trust architectures.

## Similar roles

- [Support Engineer, U.S. Government Support](https://hotfix.jobs/jobs/e6644405-c497-43e4-b9f3-6f226bcea0eb) - GitLab - Remote - $95k – $161k/yr
- [Network Security Engineer](https://hotfix.jobs/jobs/f0efef28-86e1-44dc-a35f-d98a3ed01922) - Cloudflare
- [Client Support Specialist](https://hotfix.jobs/jobs/81891290-3b70-4b10-9d8b-e562c0353b10) - Ontic - Remote - $65k – $75k/yr
- [Integrations & Technical Support Specialist](https://hotfix.jobs/jobs/90428c30-8f5d-41ee-b321-845d1ce9a1be) - ezCater - Remote - $70k – $92k/yr
- [Growth Engineer, Support Engineering](https://hotfix.jobs/jobs/adf872ea-a735-436e-8d57-354822947ffc) - Firecrawl - Remote - $205k – $250k/yr

**Apply:** https://hotfix.jobs/jobs/345480b9-81ad-4dcc-a3c4-ea9c817c0895
**Canonical:** https://hotfix.jobs/jobs/345480b9-81ad-4dcc-a3c4-ea9c817c0895