Product Security Engineer

• Support security assessments and vulnerability operations for Cloudflare’s core software products. • Analyse system architecture, threat model new features, and make sure product security findings are triaged accurately. • Route findings to the correct engineering owners and track them to mitigation within agreed SLAs. • Run deep-dive security reviews on new feature designs, triage complex bug bounty submissions, and resolve vulnerabilities surfaced by SAST, fuzzing, and penetration tests. • Work autonomously to spot where manual processes slow the team down. • Write code and integrate AI and LLM solutions to automate initial triage and data enrichment, building tools that handle security findings at scale. • Sit at the intersection of Product Security, Vulnerability Operations, and internal AI tooling. • Work from London on a hybrid basis, with the role also open in Austin.

• Bring 5+ years of experience in Product or Application Security within large-scale distributed cloud environments or SaaS platforms. • Build production-grade automation scripts and tools. • Bring hands-on engineering experience using AI and LLMs to solve operational or technical challenges. • Bring competency in threat modelling methodologies and evaluate code flaws to determine their real engineering and security impact. • Bring experience tracking, routing, and driving remediation of software vulnerabilities across engineering groups against defined SLAs. • Collaborate effectively across teams, communicating technical security risks clearly to software engineers. • Resolve ownership ambiguity constructively rather than letting findings stall.

• Bring experience conducting academic or vulnerability research focused on systems security. • Bring familiarity with modern exploitation techniques, fuzzing frameworks, or automated scanning utilities. • Bring experience scaling crowdsourced security programmes such as HackerOne or Bugcrowd. • Optimise agile project management workflows within JIRA. • Bring experience integrating hardware security features into production codebases. • Spot problems everyone else has normalised and build a solution with the latest tools.

• Identify process bottlenecks and build AI-driven tools or scripts that automate code analysis, optimise triage, and streamline Product Security workflows. • Conduct structured security reviews and threat modelling sessions such as STRIDE across product features, defining security requirements early in the development lifecycle. • Manage the operational lifecycle of product security findings, verifying vulnerabilities and mapping them to the correct engineering owner. • Track findings to mitigation in line with established SLAs. • Perform technical triage and validation of external Bug Bounty submissions, verifying exploitability and evaluating business risk. • Support internal and external penetration testing engagements by reviewing findings, clarifying technical context, and helping development teams with remediation. • Partner closely with DevOps and product teams as a reliable security point of contact. • Help developers implement secure coding practices.

We have used Cloudflare products ourselves, including Turnstile to protect apps from bots, so we know first-hand how solid their tech is, and that matters when you are thinking about where to work. With over $2.1 billion in annual revenue, 34% growth in Q4 2025, and $4 billion+ in cash reserves, Cloudflare is financially rock-solid and still growing fast. They operate one of the largest networks in the world, sit in front of roughly one in five websites, and are pushing hard into AI infrastructure and the agentic web. The scale of what they do is genuinely impressive; so many of the apps and services you use every day depend on Cloudflare without you even knowing it. Across Glassdoor, employees consistently highlight the great products, friendly and smart colleagues, positive working environment, and genuine flexible hybrid and work-from-home arrangements. They also offer unlimited paid time off and have a real focus on diversity and inclusion. We should be upfront, though: the Glassdoor rating sits at 3.4, and reviews are mixed. While the culture and people are widely praised, compensation competitiveness and slow promotion processes are recurring pain points. However, if you want to solve hard, Internet-scale problems at a company whose products you probably already rely on, Cloudflare is a brilliant place to do that.

• Take part in Cloudflare’s equity plan. • Access a complete package of benefits and programmes supporting you and your family, though specifics vary outside the United States. • Take flexible paid time off covering both vacation and sick leave. • Use leave programmes including parental, pregnancy health, medical, and bereavement leave. • Draw on on-demand mental health support and an Employee Assistance Programme. • Build AI tooling yourself rather than only consuming what others provide. • Work on bug bounty triage and penetration testing for a major internet platform. • Contribute to public interest work including Project Galileo, the Athenian Project, and the 1.1.1.1 resolver.

Cloudflare is on a mission to help build a better Internet, running one of the world’s largest networks and powering millions of websites and Internet properties for customers from individual bloggers to Fortune 500 companies. It protects and accelerates any Internet application without added hardware, installed software, or code changes, routing traffic through an intelligent global network that gets smarter with every request. Fundamental to its mission is protecting the free and open Internet: Project Galileo has equipped more than 2,400 journalism and civil society organisations across 111 countries with protection at no cost, and the Athenian Project has served more than 425 local government election websites across 33 states. Its culture favours builders and curiosity over bureaucracy.