Customer Engineering Specialist - Network Services

Locations: Lisbon

Customer Engineering Specialist - Network Services

About the role

As a CE Specialist you will be the trusted technical advisor for customers adopting Cloudflare's network services. These include Magic Transit, Cloudflare WAN, Cloudflare Network Firewall and Cloudflare Network Interconnect (CNI), alongside Cloudflare One. You will lead Magic Transit and Cloudflare WAN POCs from design through to production cutover. You will also help customers modernize how they protect, connect and secure their networks and sites.

Responsibilities

• Act as a trusted advisor, helping customers choose the right Cloudflare network and security solution for their business needs.
• Lead qualified prospects through Solution Design and POC.
• Magic Transit: plan and run POCs covering BGP onboarding, prefix advertisement, GRE/IPsec tunnels or CNI, and DDoS validation.
• Cloudflare WAN: plan and run POCs covering site and branch connectivity (IPsec/GRE tunnels, CNI, Cloudflare One Appliance), data center and cloud-to-site connectivity, routing design, and coexistence with or migration from existing SD-WAN or MPLS.
• Understand the customer's network topology, IP addressing, routing policy and security requirements. Then design an architecture that fits, including hybrid environments with Azure, AWS and GCP.
• Run technical discovery, demos and workshops as part of the pre-sales cycle. Support RFP/RFI responses and technical validation.
• Explain the benefits of Magic Transit, Cloudflare WAN and Cloudflare One compared with alternative approaches. These include traditional DDoS scrubbing services, appliance-based protection, SD-WAN solutions, next-generation firewalls and MPLS or traditional WAN.
• Work with GTM partners to consistently achieve pipeline and revenue goals.
• Present network and security transformation messages to senior technical leaders and executives.
• Capture product and feature gaps and feed them back to Product and Engineering.

Core requirements

• GTM experience: 5+ years in Customer Engineering, Pre-sales, Solutions or Systems Engineering, or Technical Sales. You should have experience guiding customers through discovery, solution design, POC and handover to delivery or support.
• BGP and routing: Strong working knowledge of BGP (eBGP, route advertisement and filtering, AS paths, communities, anycast, RPKI and route hygiene). You should also be comfortable with static and dynamic routing, subnetting, route-based policy and split tunnels.
• TCP/IP: Deep understanding of the TCP/IP protocol stack and packet-level troubleshooting (for example with tcpdump and Wireshark). This includes MTU/MSS, tunneling (GRE, IPsec), NAT and asymmetric routing.
• DDoS protection: Understanding of L3/L4/L7 DDoS attack types and mitigation approaches (for example volumetric floods, SYN floods, amplification and reflection attacks). You should also understand how on-demand and always-on protection differ.
• SD-WAN and WAN architecture: Familiarity with SD-WAN architectures and routing protocols (BGP and OSPF overlays), underlay and overlay design, local internet breakout, branch connectivity, and migration from MPLS or legacy WAN.
• Fluent in English, written and spoken. Additional languages are a plus.
• Ability to manage a project, work to deadlines and prioritize between competing goals.
• Curiosity and learning agility. Cloudflare sits at the cutting edge of internet technology, so you are expected to keep up with industry trends as well as our own products.

Desirable skills

Network and security fundamentals

• DNS: Good knowledge of DNS, including authoritative and recursive resolution, DNSSEC, DNS over HTTPS/TLS, DNS-based attacks (such as tunneling and cache poisoning) and DNS filtering.
• Detailed understanding of the path from user to application, including hybrid and multi-cloud architectures (Azure, AWS, GCP).
• Knowledge of end-user and application security risks. These include DDoS, malware, phishing, viruses, ransomware.
• VPN and remote access challenges, and moving to Zero Trust access.
• SIEM and log analytics platforms. You should also be comfortable with network telemetry such as NetFlow and sFlow.
• Experience and knowledge with network and security vendors, including Cisco, Juniper, Fortinet, Palo Alto Networks, and Check Point (covering architecture, capabilities, configuration, and troubleshooting).

Market and competitive knowledge

• Understanding of the market for CDN providers, Web Application Firewalls, remote access solutions, next-generation firewalls, CASB, DDoS mitigation, SD-WAN and secure gateway solutions.

Cloudflare One and Zero Trust

• SASE concepts and Zero Trust networking architectures.
• Knowledge of Cloudflare Zero Trust solutions: Access, Gateway, Browser Isolation, and WARP client deployment.
• Secure Web Gateway, CASB and DLP.
• IdP and authentication (SAML, OTP), plus SaaS application integration and tenant controls.
• Client OS fundamentals and software distribution.

Compensation

For Portugal based hires: Estimated annual salary is between €74,000 - €106,000.

What Makes Cloudflare Special?

Please note that applicants who progress to the offer stage of the interview process may be asked to attend an in-person interview within one of the Cloudflare Offices or Cloudflare Hubs. More details about this will be available at that stage of the interview process.

This position may require access to information protected under U.S. export control laws, including the U.S. Export Administration Regulations. Please note that any offer of employment may be conditioned on your authorization to receive software or technology controlled under these U.S. export laws without sponsorship for an export license.

Cloudflare is proud to be an equal opportunity employer. We are committed to providing equal employment opportunity for all people and place great value in both diversity and inclusiveness. All qualified applicants will be considered for employment without regard to their, or any other person's, perceived or actual race, color, religion, sex, gender, gender identity, gender expression, sexual orientation, national origin, ancestry, citizenship, age, physical or mental disability, medical condition, family care status, or any other basis protected by law.