Senior Detection and Response Engineer

Responsibilities

• Define the technical direction, roadmap, tooling needs, and operating standards for detection and response at Faire.
• Build enterprise detection engineering end to end, including telemetry pipelines, detection content, alert routing, and enrichment.
• Track adversary behavior and translate it into detections, threat hunts, and tabletop exercises.
• Own detection and data pipelines written as infrastructure as code.
• Automate alert triage, enrichment, and response workflows.
• Partner with IAM, CPE, network engineering, IT infrastructure engineering, and Enterprise Security teams to obtain telemetry and improve controls.
• Investigate incidents across identity providers, laptops, cloud environments, SaaS applications, and administrative consoles, and communicate root causes to responsible teams.

Requirements

• Deep hands-on experience in detection engineering, incident response, or security operations, with a track record of building security capabilities.
• Experience with corporate attack surfaces including identity providers and SSO, endpoint and EDR telemetry, email security, SaaS logs, device management signals, and corporate network access.
• Strong proficiency in Python and a query language such as SQL.
• Ability to build and maintain detection-as-code pipelines directly.
• Practical experience with SIEM, EDR, and security analytics platforms.
• Investigative experience across endpoints, cloud environments, and SaaS applications, including distinguishing known facts from inferences.
• Strong written communication and ability to collaborate with engineers and leadership.
• Preferred experience includes founding security roles, insider threat or data loss detection, offensive security focused on corporate identity and endpoints, incident command, endpoint or cloud forensics, or determining which data belongs in a SIEM versus a data warehouse.

Benefits

• Base salary range of $174,500 to $240,000 per year in San Francisco, plus equity and benefits.
• Hybrid schedule of three office days per week on Tuesdays, Thursdays, and one flex day on Monday, Wednesday, or Friday.
• Hybrid employees may work remotely for up to four weeks per year.
• Competitive pay, equity, and comprehensive benefits.
• Equal employment opportunity and reasonable accommodation support are provided.