Incident Response Analyst

REACT Consultant performing incident response, active edge mitigation, forensics, and threat containment for Cloudflare customers across on-prem, cloud, and hybrid environments. Requires 3+ years cybersecurity experience including 2+ years in IR/forensics, strong network and OS knowledge, and customer-facing skills.

About the job

Key Responsibilities

Incident Response & Active Edge Mitigation

Execute immediate defensive maneuvers at the Cloudflare edge to protect customer availability, including deploying custom WAF rules, implementing L3/L4 DDoS shunning, and performing real-time traffic filtering.
Support the full IR lifecycle (investigation, containment, remediation, recovery) for clients, review technical deliverables, and coordinate with customer stakeholders.
Build understanding of targeted attacks to create and execute customized tactical and strategic remediation plans.

Direct Customer Containment & Threat Isolation

For ransomware and BEC: identify and isolate infected hosts, revoke compromised sessions/identities, and stop data exfiltration.
For insider threats and nation-state attacks: track lateral movement, identify persistent backdoors, correlate threat actor activity, and execute containment while preserving evidence.

Forensics, Engineering & AI Analysis

Conduct initial evidence preservation (logs, volatile memory, disk images) according to forensic standards.
Create and enhance client-facing Crisis & Incident Response solutions based on ISO 27001, NIST, CIS standards; identify opportunities for process optimization.
Utilize AI-powered security platforms to synthesize telemetry, automate log summarization, and accelerate threat pattern identification.
Prepare high-fidelity incident reports, forensic findings, and client communications.

Requirements

Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or related field (or equivalent experience).
3+ years in cybersecurity, including 2+ years in Incident Response/Digital Forensics and 1+ years in a customer-facing role.
In-depth understanding of Windows; general knowledge of Unix, Linux, Mac.
Familiarity with cloud environments (AWS, Azure, O365, Google Cloud, Cloudflare) and cloud IR methodologies.
Strong knowledge of network protocols (TCP/IP, HTTPS, FTP, SFTP, SSH, RDP, CIFS/SMB, NFS); experience with tools like Bro/Zeek or Suricata.
Solid understanding of MITRE ATT&CK and NIST frameworks.
Excellent verbal and written communication skills for executive and technical audiences.

Nice-to-Haves

Proficient in Python or Golang for writing scripts.
Proficient with Yara for writing detection rules.
Understanding of source code, hex, binary, regex, data correlation, and analysis of network flows/system logs.
Practical malware analysis (static, dynamic, automated); reverse engineering file formats.
Reverse engineering experience with APT malware, including infection vectors, infrastructure enumeration, attribution, and evasion tactics.
Familiarity with bash for static analysis and IOC investigation.

Skills

Incident Response, Digital Forensics, Mitre Att&Ck, Nist, Windows, Linux, AWS, Azure, Python, Go, Yara, Network Forensics, Malware Analysis, Reverse Engineering