Email Security Detections Developer

At Cloudflare, we have our eyes set on an ambitious goal: to help build a better Internet. Today the company runs one of the world’s largest networks that powers approximately 25 million Internet properties, for customers ranging from individual bloggers to SMBs to Fortune 500 companies. Cloudflare protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare all have web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures list and ranked among the World’s Most Innovative Companies by Fast Company. 

We realize people do not fit into neat boxes. We are looking for curious and empathetic individuals who are committed to developing themselves and learning new skills, and we are ready to help you do that. We cannot complete our mission without building a diverse and inclusive team. We hire the best people based on an evaluation of their potential and support them throughout their time at Cloudflare. Come join us! 

Available Locations:  Austin - US, Lisbon - Portugal, Mexico City - Mexico

About the Department

Cloudforce One is Cloudflare’s threat operations and research team, responsible for identifying and disrupting cyber threats ranging from sophisticated cyber criminal activity to nation-state sponsored advanced persistent threats (APTs).  Cloudforce One works in close partnership with external organizations and internal Cloudflare teams, continuously developing operational tradecraft and expanding ever-growing sources of threat intelligence to enable expedited threat hunting and remediation.  Members of Cloudforce One are at the helm of leveraging an incredibly vast and varied set of data points that only one of the world’s largest global networks can provide.  The team is able to analyze these unique data points, at massive scale and efficiency, synthesizing findings into actionable threat intelligence to better protect our customers.

About the Role

Cloudflare is a system spanning the globe, on a mission to make the internet better, safer, and more powerful everyday.  To help fulfill this mission, we are seeking a talented Security Detections develop to help develop the tools we use to identify, track, and defeat sophisticated email-borne cyber threats.  

In this position, you will be a developer supporting the critical tools Cloudflare uses to detect, process and analyze emails that are sent to our customers. You will support multiple full stack applications mainly using Golang, React, Redis, Postgres, and Kubernetes. Additionally, you will spend 20% of your time examining and mitigating email based threats in real time, leveraging emerging technologies to build detections that protect millions of people from phishing attacks.  Your efforts will help us in our constant pursuit of reaching far beyond today’s email security market.

As a Security Detections Developer, you will need to have the skills to write highly reliable code, while also being able to write YARA based detections to catch emerging email threats. This role is 80% software development, and 20% email detections. Your analytical thinking and quick action will be the key to our success. You will identify Tactics, Techniques, and Procedures (TTPs) of ongoing and ever-evolving cyber attacks to protect our global customer base.  You will work in close collaboration with team members to develop new and innovative ways to present and interact with our unique insights.  

Examples of desirable skills, knowledge and experience

• Software development skills, with preferred experience programming in Go, React and Python
• Experience with test frameworks, such as the Go testing package, GoMock, and React testing
• Ability to stand up infrastructure using Kubernetes
• Understanding of APIs, and how to access data between separate systems using APIs
• Ability to write maintainable documentation that outlines how to use a system, method definitions, and API documentation
• Experience in one of the following: Email and/or Metadata analysis
• A passion for analyzing attacker TTPs at varying levels 
• Ability to understand the latest security trends as they relate to email-borne threats
• Experience using a comprehensive data analysis platform and rule configuration
• Understanding of the cyber threat landscape, cyber intelligence, and working knowledge of threat actors and their techniques
• Experience tracking and analyzing cyber campaigns utilizing technical Indicators of Compromise (IOCs)
• Abi