Staff Security Engineer

Who you are

• Hands-on operational ownership of a CDN or edge security platform (Cloudflare, Akamai, Fastly, or AWS CloudFront/WAF/Shield) in production against real adversaries, managed as code rather than clicked through a vendor dashboard
• Experience defending a high-traffic consumer site against scraping and application-layer DDoS, including the part where the attacker shifts vectors a week after your control ships, and the instinct to design for raising attacker cost rather than for a permanent block
• A practical understanding of bot detection signals and where each one fails: TLS and HTTP fingerprinting (JA3/JA4), behavioural signals, mobile device attestation (App Attest, Play Integrity), and challenges, with a real view on the precision and recall trade-off each one carries
• Experience designing distributed rate limiting at layer 7, including the differences between per-IP, per-ASN, per-session, and per-fingerprint keying, when each gets evaded, and how to hold counter state across a fleet without the limiter becoming the bottleneck
• Quantitative rigour in detection work: you can measure a detection's precision and recall, set a false-positive tolerance with the business, and defend a threshold change with data rather than intuition
• A preference for solving traffic and abuse problems with code rather than manual operations, including writing and maintaining internal tooling that on-call engineers depend on mid-incident
• Comfort writing and reviewing code in an OOP language such as Kotlin, Java, Python, or TypeScript, enough to read an unfamiliar service, find where a control is being bypassed, and open the pull request that fixes it
• Working fluency with infrastructure as code and cloud environments (Terraform, AWS or GCP, Kubernetes) sufficient to own a security control plane, and the judgment to know when a Terraform-gated workflow is too slow for an incident and needs a break-glass path with an audit trail
• Experience owning incident response for a live traffic attack, including holding the authority to block traffic under time pressure
• A track record of setting technical direction in an ambiguous domain with no existing owner, and of sequencing work when everything is nominally urgent
• Experience landing a cross-team ownership model without authority, including moving responsibility away from a team that currently holds it and getting other teams to accept obligations they did not ask for
• Comfort delivering primarily through other teams rather than personal throughput
• The ability to put security risk in business terms for executives, translating traffic and abuse metrics into revenue, cost, and reputational exposure
• Clear communication with engineers outside security, describing an attack and its trade-offs without alarmism or unexplained jargon

What the job involves

• Our Engineering organization owns the software that makes our marketplace work
• Our Bot & Traffic Defence function owns how Faire holds up against automated traffic: scraping, credential abuse, and application-layer DDoS, from the edge through to detection and scoring
• We care about good engineering practice and love to write software that is secure, tested, easy to maintain, and can scale to millions of users
• We build scalable, reusable frameworks; consult with product teams; listen to the data; and iterate
• As a Staff Security Engineer, Bot & Traffic Defence, you will be the first dedicated owner of this domain
• You will set the technical direction, build the controls and signals that back it, and establish an ownership model that holds across Security, Platform, service teams, and Anti-Abuse
• Own the technical strategy and roadmap for bot, scraping, and application-layer DDoS defence end to end, from edge controls through detection and scoring, including revising the strategy where the evidence contradicts it
• Author and tune edge security controls as code: WAF rules, rate limiting policies, and challenge mechanisms, against real adversaries who respond to every change you make
• Build higher-confidence bot and trust signals so that Faire can enforce more aggressively without turning legitimate logged-out buyers away
• Design and operate distributed layer 7 rate limiting, and make the calls on keying, counter state, and where in the stack enforcement belongs
• Make incident response for bot and DDoS events a solved problem: clear paging paths, runbooks a non-specialist on-call can execute at 3am, and observability that answers whether humans are actually being affected
• Lead post-incident reviews on recurring classes of bot incidents so systemic causes surface instead of repeating
• Build the tooling, secure defaults, and playbooks that let service-owning teams protect their own endpoints correctly without you in the loop for every decision
• Land a durable ownership model across Security, Platform, service teams, and Anti-Abuse, where every attack vector has a named owner who has accepted it and it holds without escalation
• Make Faire's bot posture legible to leadership, including a defensible view of residual risk, and force the outstanding business decisions that engineering is currently making by default
• Technologies we use and teach:
• Kotlin, Typescript, Python
• Edge and CDN security tooling: WAF, rate limiting, bot management, challenge policies
• AWS, OCI, Terraform, Kubernetes
• HTTP, JSON, and Protocol Buffers

Benefits

• Comprehensive healthcare: Including Health, Dental, Vision and Disability for all our locations.
• Time off: Paid time off, holidays and company-wide "Faire Fundays".
• Parental leave: Generous parental and family leave, as well as fertility support benefits.
• Productivity support: Monthly stipends to help cover work from home connectivity needs.
• Annual learning grant: For personal and professional development, as well as unlimited access to training courses through LinkedIn Learning.
• Thoughtfully designed spaces: All of our offices have been designed with local in mind – from our architects to our coffee blends.
• Fitness and well-being benefits: Including monthly credit towards your wellness-related programmes.
• Mental health benefits: Including free access to Modern Health therapists and resources.
• Charitable matching: Faire will match up to £250 of your charity donations, every year.
• Career planning: Whether you want to grow as a leader, hone your craft or explore a new discipline, our career framework allows space for you to explore.