Staff Security Engineer - Bot & Traffic Defence

About the role

Faire is a technology wholesale platform connecting independent retailers worldwide. Its Engineering organization owns the marketplace software, and its Bot & Traffic Defence function protects against automated traffic such as scraping, credential abuse and application-layer DDoS, from the edge through detection and scoring. As the first dedicated owner of this domain, you will set the technical direction, build the controls and signals, and establish an ownership model across Security, Platform, service teams and Anti-Abuse.

Key responsibilities

• Own the technical strategy and roadmap for bot, scraping and application-layer DDoS defence, from edge controls through detection and scoring.
• Author and tune edge security controls as code: WAF rules, rate limiting policies and challenge mechanisms.
• Build higher-confidence bot and trust signals so legitimate logged-out buyers are not turned away.
• Design and operate distributed layer 7 rate limiting, including keying, counter state and where enforcement belongs in the stack.
• Make incident response for bot and DDoS events reliable: paging paths, runbooks and observability, and lead post-incident reviews.
• Build tooling, secure defaults and playbooks so service teams can protect their own endpoints.
• Establish a durable ownership model across teams and make Faire's bot posture legible to leadership.

Required profile

• Hands-on operational ownership of a CDN or edge security platform (Cloudflare, Akamai, Fastly or AWS CloudFront/WAF/Shield) managed as code.
• Experience defending a high-traffic consumer site against scraping and application-layer DDoS.
• Understanding of bot detection signals (TLS/HTTP fingerprinting, behavioural signals, mobile attestation, challenges) and their precision-recall trade-offs.
• Experience designing distributed layer 7 rate limiting and measuring detection precision and recall.
• Track record of setting technical direction in an ambiguous domain and landing a cross-team ownership model without authority.
• Ability to explain security risk in business terms to executives.

Required skills

• OOP languages such as Kotlin, Java, Python or TypeScript.
• Infrastructure as code and cloud environments (Terraform, AWS or GCP, Kubernetes).
• WAF, rate limiting, bot management and challenge policies.
• HTTP, JSON and Protocol Buffers.

What we offer

• Pay range of $231,000 to $318,000 per year in San Francisco, plus equity and benefits.
• Hybrid work: 3 days in the office per week, with remote work up to 4 weeks per year.
• Paid time off, recharge days, paid parental leave up to 16 weeks, fertility and family-building benefits, mental health support, stipends and a retirement plan.