C

Cloudflare

Secures websites and runs apps on its network

Product Manager Intern

Summer 2027Updated
No salary listed
Internship
Bachelor's, Master's
Austin, TX, USA
HybridIn-office 3–5 days per week in Austin; in-person interview may be required at a Cloudflare office or hub.
ProductProduct Management
Company Historically Provides H1B Sponsorship

About the job

Requirements
  • Currently pursuing a Bachelor's or Master's degree in Computer Science, Human-Computer Interaction, Business, Engineering, or a related field.
  • Be able to commit to a full-time 40-hour-per-week, 12-week internship and avoid conflicting classes during the internship term.
  • Work in the Austin office 3–5 days per week; remote and part-time applicants are not considered.
  • Have technical literacy to understand architectural concepts and empathize with developer workflows.
Responsibilities
  • Conduct user research and competitive analysis to understand user needs and market trends, and identify pain points and opportunities.
  • Collaborate with engineering, design, and product leaders to bring product concepts to life and ensure features meet specifications and user expectations while solving technical problems at scale.
  • Help define success metrics and ensure launched features are technically sound, create measurable business value, and solve user problems.
  • Analyze challenges, balance technical feasibility with user needs, and turn market constraints into opportunities for innovation and growth.
  • Own a project focused on improving products, enhancing user experience, and driving the development of key features.
Desired Qualifications
  • Have a strong passion for technology and empathy for user needs.
  • Have strong analytical, problem-solving, and organizational skills.
  • Communicate complex concepts clearly in writing and verbally to technical and non-technical audiences.
  • Take initiative and work effectively in ambiguous situations.
  • Have familiarity with networking, security, or Zero Trust concepts, including TCP/IP, HTTP, or DNS.
  • Have hands-on experience with developer tools, APIs, or personal projects using Cloudflare products.
  • Have previous experience writing product specifications, building wireframes, or conducting user research.
  • Have basic coding ability or familiarity with command-line tools and developer workflows.

About the company

Cloudflare operates a network that protects websites, delivers online content and runs applications closer to their users. Businesses connect websites and internal systems to its services to filter malicious traffic, control access and improve performance, with security and computing running on shared infrastructure. Developers combine application code, object storage and databases with the network used for content delivery and traffic protection. Cloudflare earns revenue from subscriptions and usage charges, with free plans for basic features and negotiated contracts for larger organizations. Cloudflare was founded in 2009 and is headquartered in San Francisco, California.

Company Size

1,001-5,000

Company Stage

IPO

Headquarters

San Francisco, California

Founded

2009

Get referred to Cloudflare

See people who can refer or advise you

Simplify Jobs

Simplify's Take

What believers are saying

  • Demand is growing: Cloudflare reported $696 million revenue, up 36%, for the June 2026 quarter.
  • New parents get paid bonding time: qualifying Cloudflare employees receive up to sixteen paid weeks globally.
  • Attack protection has predictable billing: Cloudflare provides unmetered DDoS mitigation across all plans, including its free tier.

What critics are saying

  • Employees faced a major workforce reduction: Cloudflare announced more than 1,100 global job cuts in May 2026.
  • One software fault spread widely: Cloudflare's bot-management configuration broke core network traffic in November 2025.
  • Free users still incur costs: most Cloudflare customers pay nothing, while the company bears incremental network expenses.

What makes Cloudflare unique

  • Services share network locations: Cloudflare runs its security and delivery stack in every data center.
  • R2 makes outbound bandwidth free: Cloudflare charges for storage and requests, without fees for direct Internet data transfers.
  • Workers handles deployment and scaling: developers publish apps across Cloudflare's global network without managing servers.

Help us improve and share your feedback! Did you find this helpful?

Benefits

  • Competitive salaries
  • Take-what-you-need paid vacation policy
  • Comprehensive health plans and benefits
  • Paid maternity and paternity leave
  • Commuter and ride share options
  • Returnships

Growth & Insights and Company News

6 month growth

7%

1 year growth

8%

2 year growth

7%
ForkLog
Oct 24th, 2026
Cloudflare introduces post-quantum encryption key protection.

Cloudflare introduces post-quantum encryption key protection. Cloudflare's GeoKey Manager beta restricts key access by region. Cloudflare has launched a closed beta of the new version of GeoKey Manager, which restricts decryption key access to selected geographic regions. The solution employs a hybrid scheme of ML-KEM-768 and X25519 to guard against potential quantum computer attacks. A public release is scheduled for the first quarter of 2027. Found a mistake in the text? Select it and press CTRL+ENTER

Industry Events
Oct 24th, 2026
Cloudflare Launches Post-Quantum GeoKey Manager with Hybrid ML-KEM-768 Encryption for Regional data sovereignty.

Cloudflare Launches Post-Quantum GeoKey Manager with Hybrid ML-KEM-768 Encryption for Regional data sovereignty. Cloudflare has launched its Post-Quantum GeoKey Manager in closed beta, integrating NIST-standardized post-quantum cryptography to enforce strict geographical boundaries on customer private key access. This new system protects sensitive enterprise data against "Harvest Now, Decrypt Later" attacks and helps satisfy regional data sovereignty mandates. General availability is expected in Q1 2027. The post Cloudflare Launches Post-Quantum GeoKey Manager with Hybrid ML-KEM-768 Encryption for Regional By Quantum Computing Report Got news to share with the events industry? More in Quantum Tech & Cryptography. Related insights. Relevant events. Events in Quantum Tech & Cryptography

OVFILE
Oct 22nd, 2026
Quad9 to exit France following Paris court penalty over pirate tennis stream blocks.

Quad9 to exit France following Paris court penalty over pirate tennis stream blocks. 2 days ago - 22 October 2026 Ammar Sabilarrohman OvFile Reporter Swiss non-profit DNS resolver Quad9 has announced it is pulling out of France entirely after a Paris court ordered financial penalties over the organization's refusal to block domains broadcasting unauthorized tennis streams. Starting November 24, Quad9 will officially stop serving users in France, making it the second major public DNS resolver to abandon the country over escalating website-blocking mandates. The decision arrives in the wake of a legal battle initiated by sports broadcaster beIN Sports, which targeted Quad9 for failing to comply with a May court order requiring the blocking of pirate domains. While beIN initially demanded exorbitant daily penalties reaching up to €580,000 for non-compliance, the Paris court ultimately ruled on a lower penalty structure, setting the fine at €1,000 per day. Although significantly reduced from the broadcaster's original request, the penalty still presented an untenable financial burden for the privacy-focused foundation, particularly when compounded by roughly 20 other pending blocking cases across the country. Earlier this month, representatives for Quad9 informed reporters that the foundation was actively weighing its future in France, explicitly leaving open the possibility of a complete market withdrawal. Yesterday's ruling cemented that trajectory, prompting the Swiss-based organization to publish a definitive "Au revoir, France" statement confirming that it will no longer offer recursive DNS resolution services to internet users within French borders as of November 24. €1,000 a Day and the Burden of Compliance. The Paris Judicial Court ordered Quad9 to implement a blocking directive initially issued in May, which has since expanded to encompass 58 distinct domain names. Failure to comply would trigger a penalty of €1,000 per day. While beIN had pushed for a rate of €10,000 per day for every individual domain that remained accessible through Quad9's network, the court consolidated the figure into a single daily penalty of €1,000 running until the blocking measures expire on November 14. Quad9 calculated that this period alone accumulates to approximately €24,000 in direct fines, excluding the foundation's mounting legal expenses. In its legal reasoning, the court emphasized Quad9's own admissions. According to the judicial panel, the foundation was obligated to make reasonable efforts to restrict access to the designated domain names but deliberately chose to take zero action. This approach contrasted sharply with the outcomes of similar recent legal challenges involving other network intermediaries. Earlier this month, the same Paris court rejected penalty requests filed by beIN against Cloudflare and several prominent virtual private network (VPN) providers. Those entities had successfully implemented blocks on at least a portion of the targeted domains, a measure the court deemed a sufficient manifestation of reasonable effort. A similar outcome occurred in September when Canal+ lost a parallel penalty bid against Cloudflare regarding its 1.1.1.1 resolver. Quad9, conversely, maintained a strict policy of non-compliance, confirming in court submissions that it had not blocked a single domain on the list. Leaving France on principle. For Quad9, the dispute extends far beyond monetary fines or legal expenditure. The foundation operates under the core philosophy that recursive DNS resolution should remain a neutral public utility, fundamentally untouched by commercial or judicial alterations. In a formal statement addressing the controversy, Quad9 articulated its stance on data integrity, explaining that the organization categorically refuses to alter or misrepresent DNS responses in a manner contrary to user expectations. The foundation further noted a technical barrier inherent to its infrastructure: because its free service operates globally without requiring user registration, there is no reliable method to isolate and apply filtering exclusively to users physically located in France. While complying with the court order would technically require blocking the specified domains for all users worldwide - thereby satisfying French jurisdiction by casting a global net - Quad9 flatly rejected the notion of enforcing a local French court mandate upon internet users across the globe. When evaluating how it will technically cease service for French users, Quad9 admitted that all available methods are imperfect. Furthermore, the foundation argues that regional DNS-level blocking is largely ineffective as an anti-piracy tool. Determined users can easily bypass the restrictions by switching to any of the thousands of alternative open DNS resolvers available online. Describing the futility of the measure, the foundation compared the mandate to holding a single piece of newspaper in front of a stadium crowd to block their view of a concert. Mounting legal pressure and future outlook. The catalyst for Quad9's departure was not isolated to the immediate conflict with beIN Sports. The foundation faces approximately 20 other pending court cases in France centered around similar site-blocking demands. Executives concluded that even if individual penalties appear manageable in isolation, the cumulative weight of ongoing and future litigation would ultimately bankrupt the non-profit entity. "Quad9 cannot survive the accumulation of penalties yet to be assessed in 20 other pending cases, nor those of future cases similar to the one brought by beIN," the foundation stated, underscoring the impossibility of maintaining operations under such regulatory exposure. Quad9 is not the pioneer of this retreat. In 2024, OpenDNS similarly suspended its services in France following a piracy-blocking order brought by broadcaster Canal+. Beyond operational survival, Quad9's leadership views the broader trend of judicial blocking mandates as a dangerous precedent for digital rights and infrastructure. The foundation warns that legal mechanisms ostensibly established to protect specific commercial content rights can easily expand in scope. In the words of the organization, once the tools of censorship are constructed, they are rarely deployed sparingly or justly. While an appeal remains pending and the foundation has vowed to continue its broader fight against court-ordered DNS restrictions, its immediate chapter in France is drawing to a close. French users relying on the service have until November 24 to transition to alternative DNS providers before Quad9 formally exits the jurisdiction. Related topics.

StartupHub AI
Oct 21st, 2026
Cloudflare turned on WebMCP for 100,000 stores.

Cloudflare turned on WebMCP for 100,000 stores. Cloudflare says it enabled WebMCP at the edge for almost 100,000 Commerce.com storefronts to let shopping agents call tools instead of scraping HTML. StartupHub.ai Staff Cloudflare says it switched on WebMCP across almost 100,000 Commerce.com storefronts at the edge. The rollout builds on an August beta that injects a tiny script without merchant code changes, according to Cloudflare. Kristina Pototska, product management director at Commerce.com, said merchants want to stay in the checkout and keep customer control. "Merchants keep asking us how they can keep up with agentic shopping," Pototska said, per Cloudflare. WebMCP is a Google proposed browser standard still behind chrome://flags and Chrome Origin Trials, per Cloudflare. Partner Paid placement Agents previously scraped HTML, guessed buttons, and burned tokens on cookie banners and bot challenges. With WebMCP the agent calls search_products and add_to_cart on document.modelContext inside the shopper session. Commerce.com proxies tool definitions from its backend MCP server through Cloudflare so merchants keep logic control. Cloudflare had to add per-store opt-outs because Commerce.com runs thousands of vanity domains on shared zones via Cloudflare for SaaS. The same rollout was framed Oct. 21 as bringing AI assistants to BigCommerce merchants, reported by GlobeNewswire and not in the Cloudflare post. WebMCP remains in early preview with no general availability date while browsers keep it behind experimental flags. (C) 2026 StartupHub.ai. All rights reserved. You may not republish this article in full without a license. Search engines and AI research tools may crawl and summarize for reference. Bulk reproduction or model training requires a license. See our terms. The videos behind the news, one flip at a time. The feed mixes the videos from our articles with startup demos and you flip through them like TV channels for free with no signup. Discussion. Join the conversation below StartupHub.ai Staff Editorial team The staff writers of StartupHub.ai, ranging from investment analysts to avid AI tool users, early adopters and critical enthusiasts. Backgrounds span engineering, business and the arts. We hold every piece to rigorous standards of research and review.

GlobeNewswire
Oct 21st, 2026
Commerce and Cloudflare bring AI shopping assistants to BigCommerce merchants' online stores with WebMCP.

Commerce and Cloudflare bring AI shopping assistants to BigCommerce merchants' online stores with WebMCP. Shoppers' browser-based AI agents can now find products and fill a cart on merchants' own stores while the checkout remains on the storefront. AUSTIN, Texas, Oct. 21, 2026 (GLOBE NEWSWIRE) - Commerce.com (Nasdaq: CMRC), the open commerce ecosystem built to help merchants win as AI reshapes how customers discover and buy, today announced a partnership with Cloudflare that lets AI agents in a customer's web browser search, compare and shop directly on BigCommerce merchants' online stores with no setup required. The new functionality is turned on by default for eligible BigCommerce merchants. Shoppers increasingly ask AI agents to find and compare products for them, but most online stores were designed for people to read and click, which leaves agents guessing at buttons and forms. WebMCP is a standard that lets a website tell a shopper's browser agent directly what it sells and what it can do. For example, a shopper might ask their browser agent to "find a lightweight jacket in my size under $150." The agent can search the store's actual products and prices, add the best match to a cart and hand back a link to complete checkout on the merchant's store. For merchants, that means showing up when shoppers use AI to shop with accurate prices and stock pulled directly from the store. Merchants don't need to write code or change their site. Checkout, the customer relationship and the brand stay with the merchant. Merchants can turn off the feature in a new settings menu, which also manages all of Commerce's AI connections. "Every AI assistant is about to become a shopping assistant, and most of them are still guessing their way through storefronts the way a bot would, clicking and scraping and getting prices and inventory wrong," said Sharon Gee, senior vice president of product for AI at Commerce. "WebMCP replaces guessing with a handshake. A shopper's agent asks the store directly for what's in stock at what price in which sizes, and the store answers accurately. With this partnership, every merchant on our platform gets that handshake automatically, with no code to write and no changes to their site. Shoppers get agents that work the way they expect, and merchants stay in control of their catalog, their customers, and the sale. Commerce is ensuring our customer sites are agent-ready by default." "The web is being rebuilt for AI agents, and it's on platforms like BigCommerce and Cloudflare to handle that shift so merchants can focus on running their business," said Matthew Conroy, senior director at Cloudflare. "Together, we're giving every merchant a way to tell a shopper's agent exactly what their store can do, on their own site and on their own terms. We think that's how the agent-ready web should work: built on open standards with the site owner in control." WebMCP builds on the existing BigCommerce MCP Toolkit, which gives agents access to functions they can use to complete real-world tasks. For eligible B2C and B2B stores, BigCommerce's server-side Storefront MCPs expose shopping actions to agents connecting from outside the storefront, while WebMCP brings those actions to agents working directly in the shopper's browser. The partnership is part of Commerce's broader work to help merchants prepare their catalogs for emerging discovery experiences, reach shoppers across new channels, and support paths to purchase. About Commerce Commerce (Nasdaq: CMRC) empowers businesses to innovate, grow, and thrive by providing an open, AI-driven commerce ecosystem. As the parent company of BigCommerce, Feedonomics, and Makeswift, Commerce connects the tools and systems that power growth, enabling businesses to unlock the full potential of their data, deliver seamless and personalized experiences across every channel, and adapt swiftly to an ever-changing market. Trusted by leading businesses like Coldwater Creek, Cole Haan, Dell, Harvey Nichols, King Arthur Baking Co., Mizuno, Pacsun, Perry Ellis, Skechers, SportsShoes and Uplift Desk, Commerce delivers the storefront control, optimized data, and AI-ready tools businesses need to grow, serve diverse buyers, and operate with confidence in an increasingly intelligent, multi-surface world. For more information, visit www.commerce.com or follow us on X and LinkedIn. BigCommerce(R), the Commerce logo, and other brands are the trademarks or registered trademarks of Commerce.com Pty. Ltd. Third-party trademarks and service marks are the property of their respective owner.