About — Sam Rhea

Hi there. My name is Sam. I am a Texan living in Lisbon. I work at Cloudflare.

I'm probably busy right now building an application for a hobby project that doesn't need one. Or walking a dog we named after the second-worst highway in Austin.

At Work

Cloudflare

2018 - Present

CIO

May 2026 - Present

Equip the builders.

VP of Product

Jun 2024 - May 2026

Handed off the keys to Cloudflare Zero Trust to an amazing team I had built and returned to the lab. Helped build the future in the Emerging Technology and Incubation team at Cloudflare.

– Launched AI Audit to give publishers control of their content from AI bots.

– Helping build the future at Cloudflare. Also, Head of the Lisbon Office.

– Cloudflare Research: our frontier technology group.

– Cloudflare Privacy: making the Internet more private for anyone, anywhere.

– Cloudflare Radar: our view into the Internet.

– Cloudflare Blog: telling our story to a technical audience.

– Cloudflare Documentation: our product content team that helps users understand our products.

– Cloudflare Content Engineering: our team responsible for building the tools users need to learn how to best use Cloudflare.

– Internal AI Czar: I get to experiment with how we use AI to build better products at Cloudflare.

VP of Product, Cloudflare Zero Trust

Oct 2022 - Jun 2024

Led the Cloudflare Zero Trust product line.

– We made the biggest leap in the 2024 Gartner® Magic Quadrant™ for Security Service Edge .

– We became the only new vendor in the 2023 Gartner® Magic Quadrant™ for Security Service Edge .

– We kept customers safe while they adopted AI tools .

– Cloudflare brought the Zero Trust products into our Galileo and Athenian projects .

– Also, I killed Railgun .

Senior Director of Product

Apr 2022 - Oct 2022

Led the Cloudflare Zero Trust product line.

Director of Product

Jul 2020 - Apr 2022

Led the Cloudflare Zero Trust product line.

– Acquired Vectrix to integrate CASB capabilities for SaaS application security.

– Launched Cloudflare One , our comprehensive Secure Access Service Edge (SASE) solution.

– Launched our comprehensive DLP suite.

– Shipped Cloudflare's Secure Web Gateway .

– Gave customers the ability to require hard keys on a per-app basis.

– Brought Zero Trust control to SaaS apps , too.

– Helped customers deploy Zero Trust networks to replace their legacy networks .

– Selected by CISA to offer Internet security to US civilian agencies.

Product Manager

Jun 2018 - Jul 2020

Product Manager for Cloudflare Access, Cloudflare Registrar, and Cloudflare Tunnel.

– Launched Cloudflare Access to help teams turn off legacy VPNs.

– Shipped Cloudflare Registrar , our at-cost domain registration product.

– Added SSH , service tokens , command line flows , RDP support , and comprehensive logging to our Zero Trust platform.

– Made auth seamless by shipping the App Launcher , adding Multi-SSO support , mutual TLS flows , and per-app identity choice .

– Made Cloudflare Tunnel free for secure connections.

– Made DNSSEC one-click for all Registrar customers.

DevFactory

2013 - 2018

Product Manager

Part of the Product and Engineering assembly line component of ESW Capital.

Ginor & Associates

2012 - 2013

Associate

Becker Venture Services Group

2011 - 2012

Research Associate

Patents

Identity proxy and access gateway

US 11394710 · Jul 2022

A method for authenticating users to third-party applications through an identity proxy that enforces access rules.

Show full abstract

A server transmits to a third-party application a request for a resource that is received from a client. The server receives an authentication request from the client device that has been generated by the third-party application. The server transmits an identity provider selection page to the client device that allows the client device to select an identity provider. The server causes the client device to transmit a second authentication request to a selected identity provider. The server receives an authentication response that was generated by the identity provider that includes the identity of the user. The server enforces access rule(s) including identity-based rule(s) and/or non-identity based rule(s). If the user is permitted to access the third-party application, the server causes an authentication response to be transmitted from the client device to the third-party application that indicates the user has successfully authenticated.