About this role
About Faire
Faire is a technology wholesale platform built on the belief that the future is local. Independent retailers around the globe collectively represent a multi-hundred-billion-dollar wholesale market that has historically been fragmented and offline. At Faire, we're using the power of tech, data, and machine learning to connect this thriving community of entrepreneurs across the globe. Picture your favorite boutique in town — we help them discover the best products from around the world to sell in their stores. With the right tools and insights, we believe that we can level the playing field so businesses can grow and local communities can thrive.
We’re looking for smart, resourceful and passionate people to join us as we power the shop local movement. If you believe in community, come join ours.
About this role
As our first Detection & Response engineer, you'll build that capability from the ground up focused on our enterprise environment. Looking for and monitoring threats within identity systems our employees authenticate through, the laptops they work on, the SaaS applications that run the business, our enterprise network, and the internal infrastructure behind it. You'll decide what we monitor, build the pipelines and detections that monitor it, and write the playbooks we run when something fires. This is a zero-to-one role and it will suit someone who enjoys building with a lot of autonomy.
What You'll Do
• Shape the technical direction for detection and response at Faire. Define what good looks like, build the roadmap that gets us there, and make the case for the tooling and support it needs.
• Build detection engineering for Faire's enterprise environment end to end. Telemetry pipelines, detection content, alert routing, and enrichment.
• Bring a threat-informed point of view. Track how adversaries operate against companies like ours and translate that into detections, hunts, and tabletop exercises that test whether we'd catch it.
• Own detections and data pipelines written as IaaC.
• Automate triage, enrichment, and response so alert volume can grow without a proportional increase in analyst time.
• Work with IAM, CPE, NetEng, and IT Infrastructure Engineering to get the telemetry you need.
• Partner with Enterprise Security to translate detection findings into control improvements, and hand root causes to the teams that own them with enough context that they actually get fixed.
Qualifications
• Deep hands-on experience in detection engineering, incident response, or security operations, with a track record of building capability
• Depth in corporate attack surfaces such as identity providers and SSO, endpoint and EDR telemetry, email security, SaaS logs, device management signals, and corporate network access.
• Strong proficiency in Python and query language such as SQL.
• The ability to build and maintain detection-as-code pipelines yourself rather than specify them for someone else to bui