Threat Detection and Response Engineer

Whatnot is the largest live shopping platform in North America and Europe to buy, sell, and discover the things you love. Whether it's trading cards, fashion, electronics, or live plants, our sellers are building real businesses across hundreds of categories. We're building live commerce at a scale that's never been done in the West, and there's no playbook to copy. The people here are shaping how an entirely new industry develops.

As a remote co-located team, we're inspired by our values and anchored in hubs across the US, UK, Ireland, Poland, Germany, and Australia. We move fast, stay close to our users, and focus on the work that drives the most impact.

We're one of the fastest growing marketplaces and were recently named the #1 Best Startup Employer in America by Forbes. Check out the latest Whatnot updates on our news and engineering blogs and join us as we enable anyone to turn their passion into a business and bring people together through commerce.

Apply comprehensive knowledge and a thorough understanding of Incident Response concepts, principles, and technical capabilities

Collaborate across Information Security and business partners to ensure effective, precise, and rapid response

Act as the point of escalation from within the Incident Response team to drive all cyber incidents

Identify new detection opportunities, create playbooks, and support new technology implementations to defend against evolving threats

Maintain awareness and understanding of the current threat landscape. Analyze threat intelligence with the aim to mitigate potential risks

Report the overall health of the SOC via metrics, OKRs, and risk indicators to leadership

Provide Incident Response (IR) support when analysis suspects security incidents to help contain and eradicate threats; Perform incident triage, incident response, and forensic investigations across endpoints and cloud environments Conduct technical examinations of computer-based evidence including logs, packet captures, SIEM & IDS events, disk forensics, malware analysis, and more Document incidents from initial detection through final resolution, and present the findings