SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 231,000 - 318,000 / annual
Faire is a technology wholesale platform connecting independent retailers globally with suppliers. The Engineering organization owns the software powering the marketplace, and the Bot & Traffic Defence function protects Faire against automated threats: scraping, credential abuse, and application-layer DDoS attacks from edge through detection and scoring.
As the first dedicated Staff Security Engineer for Bot & Traffic Defence, you will own this domain end-to-end. You will set technical direction, build the controls and signals that back it, and establish an ownership model across Security, Platform, service teams, and Anti-Abuse.
Key responsibilities include:
- Own the technical strategy and roadmap for bot, scraping, and application-layer DDoS defence from edge controls through detection and scoring, revising strategy where evidence contradicts it
- Author and tune edge security controls as code: WAF rules, rate limiting policies, and challenge mechanisms against real adversaries who respond to every change
- Build higher-confidence bot and trust signals to enforce more aggressively without turning away legitimate logged-out buyers
- Design and operate distributed layer 7 rate limiting, making decisions on keying, counter state, and enforcement placement
- Make incident response for bot and DDoS events a solved problem: clear paging paths, runbooks executable by non-specialists at 3am, and observability showing whether humans are affected
- Lead post-incident reviews on recurring bot incident classes to surface systemic causes
- Build tooling, secure defaults, and playbooks enabling service-owning teams to protect their own endpoints without requiring your involvement in every decision
- Land a durable ownership model across Security, Platform, service teams, and Anti-Abuse where every attack vector has a named owner
- Make Faire's bot posture legible to leadership with a defensible view of residual risk
You will work with Kotlin, TypeScript, Python, edge and CDN security tooling (WAF, rate limiting, bot management, challenge policies), AWS, OCI, Terraform, and Kubernetes.
Requirements:
- Hands-on operational ownership of a CDN or edge security platform (Cloudflare, Akamai, Fastly, AWS CloudFront/WAF/Shield) in production against real adversaries, managed as code
- Experience defending a high-traffic consumer site against scraping and application-layer DDoS, understanding that attackers shift vectors after controls ship, with instinct to design for raising attacker cost
- Practical understanding of bot detection signals and their failure modes: TLS and HTTP fingerprinting (JA3/JA4), behavioural signals, mobile device attestation (App Attest, Play Integrity), and challenges, with real view on precision/recall trade-offs
- Experience designing distributed rate limiting at layer 7, including per-IP, per-ASN, per-session, and per-fingerprint keying differences, evasion patterns, and holding counter state across a fleet
- Quantitative rigour in detection work: measuring precision and recall, setting false-positive tolerance with business, defending threshold changes with data
- Preference for solving traffic and abuse problems with code rather than manual operations, including writing and maintaining internal tooling for on-call engineers
- Comfort writing and reviewing code in OOP languages (Kotlin, Java, Python, TypeScript) sufficient to read unfamiliar services, find control bypasses, and open fixing pull requests
- Working fluency with infrastructure as code and cloud environments (Terraform, AWS or GCP, Kubernetes) to own a security control plane, with judgment on when Terraform workflows are too slow for incidents
- Experience owning incident response for live traffic attacks, including authority to block traffic under time pressure
- Track record of setting technical direction in ambiguous domains with no existing owner, sequencing work when everything is nominally urgent
- Experience landing cross-team ownership models without authority, moving responsibility away from current owners and getting teams to accept new obligations
- Comfort delivering primarily through other teams rather than personal throughput
- Ability to put security risk in business terms for executives, translating traffic and abuse metrics into revenue, cost, and reputational exposure
- Clear communication with engineers outside security, describing attacks and trade-offs without alarmism or unexplained jargon
