Threat Detection and Response Engineer

Whatnot; Los Angeles (CA); Remote; USD 140,000 - 210,000; Full time

Benefits offered by this job

Health Insurance

WFH Support

Home office setup

Cell phone allowance

Internet allowance

Wellness allowance

Childcare allowance

401k with employer match

Job summary

Whatnot is seeking a Threat Detection and Response Engineer to join our security team in Los Angeles. You will own incident response across endpoints and cloud, drive playbooks, and partner with IR analysts and product teams to quickly contain threats and strengthen defenses.

Ideal candidates have 5+ years in cyber incident response and hands-on experience with SOAR, Chronicle SIEM, and multi-cloud environments (AWS, GCP). Strong written communication and on-call willingness are essential.

Qualifications

• Bachelor's degree in Computer Science, Information Security, a related field, or equivalent work experience.
• 5+ years’ experience in cyber incident response or similar cyber field.
• Experience with security concepts, SOAR(Tines), EDR, NDR and SIEM (Chronicle).
• Experience with multiple Cloud Service Providers (AWS, GCP).
• Excellent written communication skills to document, communicate, and report security incidents to leadership.
• On-call duties expected.

Responsibilities

• Apply comprehensive knowledge of Incident Response concepts and technical capabilities.
• Collaborate with Information Security and partners for rapid response.
• Act as escalation point within the Incident Response team.
• Identify detection opportunities, create playbooks, support new tech implementations.
• Analyze threat intelligence to mitigate risks.
• Report SOC health via metrics, OKRs, and risk indicators.

Skills

Cyber incident response

Defense-in-depth

SOAR (Tines)

EDR/NDR/SIEM

AWS/GCP

Written communication

On-call duties

Education

Bachelor's degree in Computer Science or Information Security or related field

Tools

SOAR (Tines)

EDR

NDR

Chronicle SIEM

AWS

GCP

Job description

Join the Future of Commerce with Whatnot!

Whatnot is the largest live shopping platform in North America and Europe to buy, sell, and discover the things you love. Whether it's trading cards, fashion, electronics, or live plants, our sellers are building real businesses across hundreds of categories. We're building live commerce at a scale that's never been done in the West, and there's no playbook to copy. The people here are shaping how an entirely new industry develops.

As a remote co-located team, we're inspired by our values and anchored in hubs across the US, UK, Ireland, Poland, Germany, and Australia. We move fast, stay close to our users, and focus on the work that drives the most impact.

We're one of the fastest growing marketplaces and were recently named the #1 Best Startup Employer in America by Forbes. Check out the latest Whatnot updates on our news and engineering blogs and join us as we enable anyone to turn their passion into a business and bring people together through commerce.

Role

• Apply comprehensive knowledge and a thorough understanding of Incident Response concepts, principles, and technical capabilities

• Collaborate across Information Security and business partners to ensure effective, precise, and rapid response

• Act as the point of escalation from within the Incident Response team to drive all cyber incidents

• Identify new detection opportunities, create playbooks, and support new technology implementations to defend against evolving threats

• Maintain awareness and understanding of the current threat landscape. Analyze threat intelligence with the aim to mitigate potential risks

• Report the overall health of the SOC via metrics, OKRs, and risk indicators to leadership

• Provide Incident Response (IR) support when analysis suspects security incidents to help contain and eradicate threats;

  • Perform incident triage, incident response, and forensic investigations across endpoints and cloud environments

  • Conduct technical examinations of computer-based evidence including logs, packet captures, SIEM & IDS events, disk forensics, malware analysis, and more

  • Document incidents from initial detection through final resolution, and present the findings

• Investigate, document, and report on cyber security issues

• Create and continuously improve standard processes, operating procedures, and incident response playbooks

You

Curious about who thrives at Whatnot? We’ve found that low ego, a growth mindset, and leaning into action and high impact goes a long way here.

As our next Threat Detection and Response Engineer, you should have a minimum of 5+ years of relevant experience in security, preferably in a large enterprise environment, plus:

• Bachelor’s degree in Computer Science, Information Security, a related field, or equivalent work experience.

• 5+ years’ experience in cyber incident response, or a similar cyber field, including experience with security principles, and defense-in-depth techniques

• Experience and understanding of security concepts, SOAR(Tines), EDR, NDR and SIEM (Chronicle) technologies

• Experience with multiple Cloud Service Providers (AWS, GCP)

• Excellent written communication skills with the ability to document, communicate, and report security incidents, as well as the status of the implementation and effectiveness of cybersecurity controls with product and business leaders

• Expected to perform on-call duties

Benefits

• Generous Holiday and Time off Policy

• Health Insurance options including Medical, Dental, Vision

• Work From Home Support

  • Home office setup allowance

  • Monthly allowance for cell phone and internet

• Care benefits

  • Monthly allowance for wellness

  • Annual allowance towards Childcare

  • Lifetime benefit for family planning, such as adoption or fertility expenses

• Retirement; 401k offering for Traditional and Roth accounts in the US (employer match up to 4% of base salary) and Pension plans internationally

• Monthly allowance to dogfood the app

  • All Whatnauts are expected to develop a deep understanding of our product. We're passionate about building the best user experience, and all employees are expected to use Whatnot as both a buyer and a seller as part of their job (our dogfooding budget makes this fun and easy!).

• Parental Leave

  • 16 weeks of paid parental leave + one month gradual return to work *company leave allowances run concurrently with country leave requirements which take precedence.

Please note: Whatnot will only contact you through official @whatnot.com email addresses. If you see an email impersonating a Whatnot recruiter, please disregard and report it as spam.

EOE

Whatnot is proud to be an Equal Opportunity Employer. We value diversity, and we do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, parental status, disability status, or any other status protected by local law. We believe that our work is better and our company culture is improved when we encourage, support, and respect the different skills and experiences represented within our workforce.