Incident Response Analyst

Incident Response Analyst - REACT

Available Location - Bengaluru

About the Role

Cloudflare is a system spanning the globe, on a mission to make the internet safer and more powerful everyday. To help fulfill this mission, we are seeking a talented Incident Response Analyst to join us in growing our Cloudforce One REACT organization. In this role, you will be instrumental in building a proactive and threat intelligence-driven approach to protecting Cloudflare and its customers from sophisticated and evolving threat actors.

As a REACT Consultant, you will respond to customer security incidents across on-premises, cloud, and hybrid environments. This position requires an innovative, self-starting, and detail-oriented problem solver with a passion for analyzing, tracking, and triaging malicious activity. You will engage with customers at all levels - including Executive, VP, Director, and engineering levels - serving an integral role alongside forensic analysts, threat researchers, detection engineers, and malware analysts to detect, isolate, and mitigate threats.

Key Responsibilities

1. Incident Response & Active Edge Mitigation

• Active Edge Mitigation: Execute immediate defensive maneuvers at the Cloudflare edge to protect customer availability. This includes deploying custom WAF rules, implementing L3/L4 DDoS shunning, and performing real-time traffic filtering to neutralize attacks before they reach the customer's origin.
• Support Full IR Lifecycle Management: Support and execute the end-to-end incident response process for clients (investigation, containment, remediation, and recovery). Review technical deliverables and coordinate sessions with customer stakeholders to ensure high-quality service and resolution.
• Incident Remediation: Build a strong understanding of targeted attacks to create and execute customized tactical and strategic remediation plans for compromised organizations.

Desirable Skills, Knowledge, and Experience

• Education: Bachelor's degree in Computer Science, Information Systems, Cybersecurity, a related technical field, or equivalent training/practical experience.
• Experience: 5+ years of overall experience in cybersecurity, including 2+ years of dedicated Incident Response OS & Cloud Environments: In-depth understanding of Windows operating systems and general knowledge of Unix, Linux, and Mac environments. Familiarity with cloud environments (AWS, Azure, O365, Google Cloud, Cloudflare) and cloud IR methodologies.
• Network and Web Attack Knowledge: Strong understanding of common L3/L4/L7 attack patterns, including SYN floods, UDP floods, DNS amplification, HTTP floods, credential stuffing, scraping, API abuse, account enumeration, and checkout abuse.
• Experience with JA3/JA4 fingerprinting, bot detection, behavioral traffic analysis, or API abuse investigations.
• Experience supporting customers during live DDoS, bot, or application-layer attack events.
• Solid understanding of MITRE ATT&CK and NIST Cyber Security Frameworks.
• Communications: English Fluency, Excellent verbal and written communication skills with a proven ability to establish relationships and clearly explain tasks, guidance, and complex technical findings to executive and technical clients.

Bonus Points

• Networking, Routing, and BGP Operations: Strong understanding of internet routing fundamentals, including BGP, Anycast, DNS, TCP/IP, GRE/IPsec tunneling, routing policies, prefix announcements, route propagation, RPKI, IRR, ASN ownership, and traffic engineering concepts.
• Proficient in Python or Golang, capable of writing modular code or simple scripts that can be installed on a remote system.
• Proficient with Yara and writing rules to detect similar malware samples.
• Understanding of source code, hex, binary, regular expressions, data correlation, and analysis (such as network flow and system logs).
• Practical malware analysis experience with static, dynamic, and automated techniques, including the ability to reverse engineer various file formats and analyze complex samples.
• Reverse engineering experience with APT malware with an understanding of common infection vectors, infrastructure enumeration, malware attribution, and current evasion tactics.
• Familiarity with bash command-line executables to conduct static analysis and investigate Indicators of Compromise (IOCs).