Bringing AI in at Faire

Route DDoS alerts before browsing stalls spread

Published Oct 22, 2026

You’re a forward deployed engineer working with Faire’s security and reliability team. The team is in the room.

The setting

connects independent retailers with small brands and suppliers. Its lets brands list and sell products, and lets retailers find, order and pay for them.

The fastest path to an alert decision can hide the evidence needed to protect legitimate browsing.

Cloudflare signals must expose hostile traffic quickly while Datadog and Kubernetes evidence establish whether retailer discovery is harmed.

Who you’d be doing this for

“I had three tabs open for new candles, then every page just spun while my buyer was waiting.”

Kyungmi Kim · Retail Store Owner · a character in this brief

She relies on search and brand pages to source inventory for a small independent shop.

What is at stake

Traffic bursts are leaving some retailers with slow or unavailable discovery pages while severity decisions wait on scattered evidence. You must decide whether the route's severity suggestion goes to the named owner as a finished case or whether an on-call engineer assembles the Cloudflare, Datadog and Kubernetes evidence first.

Why it isn’t already fixed

Every obvious fix costs something else. That’s the part you’d have to decide.

  • complete case packets vs on-call triage time
  • edge containment vs retailer access
  • cross-system context vs incident-path reliability
  • advisory severity vs named-owner ownership

Why Faire

Search and brand pages are the discovery path independent retailers use to turn supplier research into wholesale orders.

Written with these in mind

incident-response buildersecurity automation practitionerembedded systems problem solver

Not your kind of problem? 59 more at Faire, or browse every organization.

Where the organization context comes fromThe postings this brief was written from, and the reporting read before it.

The organization context comes from public information. The situation and characters are written for the brief.

Job postings it was written from

Public descriptions of the work at Faire. They are listed as sources, not as openings. The lines under a posting are its own words, where it meets this brief.

  • Senior Detection and Response Engineer · no longer posted
    • Automate triage, enrichment, and response so alert volume can grow without a proportional increase in analyst time.
    • Investigative depth on endpoints and in cloud and SaaS environments, so you can reconstruct what happened across an IdP, a laptop, and a SaaS admin console, and say what you know versus what you're inferring.
  • AV Engineer (opens in a new tab)
  • Staff Security Engineer - Bot & Traffic Defence (opens in a new tab)
    • Author and tune edge security controls as code: WAF rules, rate limiting policies, and challenge mechanisms, against real adversaries who respond to every change you make.
    • Working fluency with infrastructure as code and cloud environments (Terraform, AWS or GCP, Kubernetes) sufficient to own a security control plane, and the judgment to know when a Terraform-gated workflow is too slow for an incident and needs a break-glass path with an audit trail.
  • Senior Software Engineer - Product Security (opens in a new tab)
  • Senior Client Platform Engineer · no longer posted
    • Design, build, and maintain automations across our endpoint management tech stack
    • Work closely with partner teams to design the best employee endpoint experience

This is the setup. The work is inside.

Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.

Other live briefs connected to this one, and what connects them.

The same setting, from another role

Each is set around Faire’s Wholesale discovery marketplace, written for a different role. They’re separate briefs, not the same scenario.

Other problems with a similar purpose

In each of these, as in this one, the aim is to turn fragmented, conflicting operational signals into one clear, actionable call.