Senior Detection and Response Engineer

Faire's first detection and response engineer, building the capability from scratch for the company's enterprise environment: the identity systems employees sign in through, their laptops, business SaaS applications, the corporate network and internal infrastructure. Based in San Francisco.

The engineer sets technical direction and roadmap, decides what to monitor, builds telemetry pipelines, detections, alert routing and enrichment as code, automates triage and response, writes playbooks, runs threat-informed hunts and tabletop exercises, and works with IAM, client platform, network and infrastructure teams to get telemetry and fix root causes. Faire wants deep hands-on detection engineering, incident response or SecOps experience, ideally having built such a capability before, a detailed grasp of corporate attack paths through identity providers, endpoints, email and SaaS, strong Python and SQL, and SIEM and EDR experience.