Greenhouse ·
full-timeStaff Security Engineer - Bot & Traffic Defence
Faire · Kitchener-Waterloo, ON; Toronto, ON
About Faire Faire is a technology wholesale platform built on the belief that the future is local. Independent retailers around the globe collectively represent a multi-hundred-billion-dollar wholesale market that has historically been fragmented and offline. At Faire, we're using the power of tech, data, and machine learning to connect this thriving community of entrepreneurs across the globe. Picture your favorite boutique in town — we help them discover the best products from around the world to sell in their stores. With the right tools and insights, we believe that we can level the playing field so businesses can grow and local communities can thrive. We’re looking for smart, resourceful and passionate people to join us as we power the shop local movement. If you believe in community, come join ours. About this role: Our Engineering organization owns the software that makes our marketplace work. Our Bot & Traffic Defence function owns how Faire holds up against automated traffic: scraping, credential abuse, and application-layer DDoS, from the edge through to detection and scoring. We care about good engineering practice and love to write software that is secure, tested, easy to maintain, and can scale to millions of users. We build scalable, reusable frameworks; consult with product teams; listen to the data; and iterate. As a Staff Security Engineer, Bot & Traffic Defence, you will be the first dedicated owner of this domain. You will set the technical direction, build the controls and signals that back it, and establish an ownership model that holds across Security, Platform, service teams, and Anti-Abuse. As a Staff Security Engineer, Bot & Traffic Defence, you’ll collaborate with us to: Own the technical strategy and roadmap for bot, scraping, and application-layer DDoS defence end to end, from edge controls through detection and scoring, including revising the strategy where the evidence contradicts it. Author and tune edge security controls as code: WAF rules, rate limiting policies, and challenge mechanisms, against real adversaries who respond to every change you make. Build higher-confidence bot and trust signals so that Faire can enforce more aggressively without turning legitimate logged-out buyers away. Design and operate distributed layer 7 rate limiting, and make the calls on keying, counter state, and where in the stack enforcement belongs. Make incident response for bot and DDoS events a solved problem: clear paging paths, runbooks a non-specialist on-call can execute at 3am, and observability that answers whether humans are actually being affected. Lead post-incident reviews on recurring classes of bot incidents so systemic causes surface instead of repeating. Build the tooling, secure defaults, and playbooks that let service-owning teams protect their own endpoints correctly without you in the loop for every decision. Land a durable ownership model across Security, Platform, service teams, and Anti-Abuse, where every attack vector has a named owner who has accepted it and it holds without escalation. Make Faire's bot posture legible to leadership, including a defensible view of residual risk, and force the outstanding business decisions that engineering is currently making by default. We’re excited about you because you have: Hands-on operational ownership of a CDN or edge security platform (Cloudflare, Akamai, Fastly, or AWS CloudFront/WAF/Shield) in production against real adversaries, managed as code rather than clicked through a vendor dashboard. Experience defending a high-traffic consumer site against scraping and application-layer DDoS, including the part where the attacker shifts vectors a week after your control ships, and the instinct to design for raising attacker cost rather than for a permanent block. A practical understanding of bot detection signals and where each one fails: TLS and HTTP fingerprinting (JA3/JA4), behavioural signals, mobile device attestation (App Attest, Play Integrity), and challenges, with a real view on the precision and recall trade-off each one carries. Experience designing distributed rate limiting at layer 7, including the differences between per-IP, per-ASN, per-session, and per-fingerprint keying, when each gets evaded, and how to hold counter state across a fleet without the limiter becoming the bottleneck. Quantitative rigour in detection work: you can measure a detection's precision and recall, set a false-positive tolerance with the business, and defend a threshold change with data rather than intuition. A preference for solving traffic and abuse problems with code rather than manual operations, including writing and maintaining internal tooling that on-call engineers depend on mid-incident. Comfort writing and reviewing code in an OOP language such as Kotlin, Java, Python, or TypeScript, enough to read an unfamiliar service, find where a control is being bypassed, and open the pull request that fixes it. Working fluency with infrastructu
| Role | Staff Security Engineer - Bot & Traffic Defence |
|---|---|
| Company | Faire |
| Location | Kitchener-Waterloo, ON; Toronto, ON |
| Type | internship |
| Compensation | Not disclosed |
| Posted | 2026-09-29 |
| Deadline | Rolling |
Typical process for this type of role
A general guide — the exact steps for this specific listing may vary; check the original posting for details.
- 1ApplicationSubmit your resume through the apply link.
- 2ScreeningRecruiter reviews your background against the role.
- 3AssessmentA technical test, assignment, or coding round, depending on the role.
- 4Interview(s)One or more rounds with the hiring team.
- 5OfferOffer letter with compensation and start date.
Before you apply
0/4Staff Security Engineer - Bot & Traffic Defence at Faire: frequently asked questions
- What is the salary for this role?
- Faire has not stated compensation in the listing. Check the original posting or ask during the application process.
- Is the Staff Security Engineer - Bot & Traffic Defence position remote, hybrid or onsite?
- The listing gives Kitchener-Waterloo, ON; Toronto, ON as the location and does not state a work mode.
- What is the application deadline?
- Faire has not listed a fixed deadline, so apply early in case the opening is filled.
- How do I apply for the Staff Security Engineer - Bot & Traffic Defence role?
- Use the Apply button on this page. It opens the original listing on boards.greenhouse.io, where you submit your application with the company.
More at Faire
Other jobs at Faire
- Senior Brand Success Manager - Bilingual (korean/english) · Remote - US
- Senior Account Executive Bilingual (german/english) · London
- Senior Recruiter · San Francisco, CA
- Senior Technical Recruiter, AI/ML · San Francisco, CA
- Product Manager - Multiple Levels · New York City, NY; San Francisco, CA; Toronto, ON
Explore Related Placements
// similar opportunities
You might also like
Senior Security Engineer - Application Security
Faire
About Faire Faire is a technology wholesale platform built on the belief that the future is local. Independent retailers around the globe collectively represent...
Staff + Software Security Engineer, Labs
Anthropic
About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for s...
Senior Staff Engineer, Product Security
Druva
About Druva Druva is the resilience foundation for the AI enterprise, helping organizations secure and recover from connected risk across data, cyber, identity,...
Sr. Staff Engineer, Endpoint Security
Netskope
Join the Future of Security at Netskope Netskope (NASDAQ: NTSK) is a leader in modern security and networking for the cloud and AI era. We secure and accelerate...
Sr. Staff Engineer, Endpoint Security
Netskope
Join the Future of Security at Netskope Netskope (NASDAQ: NTSK) is a leader in modern security and networking for the cloud and AI era. We secure and accelerate...
Senior Security Engineer
Mixpanel
About Mixpanel Mixpanel is the leading product intelligence and analytics platform, trusted by more than 29,000 companies to help understand how people use the ...