Staff Security Engineer, Abuse Control

Stripe; Dublin; On-site; EUR 132,000 - 198,000; Full time

Benefits offered by this job

Equity

Bonus

Retirement plans

Health benefits

Wellness stipends

Job summary

Stripe seeks an Abuse Control Engineer (ACE) to design, prototype, and incubate defenses safeguarding Stripe's financial ecosystem. You will translate threat intelligence into precise controls like rate limits, step-up challenges, and input validation, while balancing risk reduction with legitimate user conversion.

You will lead rapid prototyping, experiments, and regression testing across API and product boundaries, partnering with cross-functional teams to transfer mature defenses to product

Qualifications

• Minimum 10+ years in security or anti-abuse in a high-scale production env.
• A degree in CS/cybersecurity/software engineering or equivalent.
• Strong software dev background with Python/Go/Java and strong SQL skills.
• Experience using frontier AI models for development and analysis.
• Hands-on building API safeguards, rate-limiting, auth checks, input validation.
• Experience with automated testing: unit/integration/regression for backend.

Responsibilities

• Rapid prototyping: design and deploy technical controls across API, protocol, and product boundaries.
• Translate attacker evidence into precise abuse requirements and control specs.
• Co-design resilient controls across payments, onboarding, identity, and Connect.
• Run risk experiments and A/B tests to balance security with user conversion.
• Build regression test suites and automated attack simulations with ACE.

Skills

Security engineering

Software engineering

Python

Go

Java

SQL

API security

Automated testing

Cross-functional collaboration

Education

Bachelor's or Master's in CS/cybersecurity/software eng

Tools

Databricks

Trino

PySpark

Job description

About Stripe

Stripe is a financial infrastructure platform for businesses. Millions of companies - from the world's largest enterprises to the most ambitious startups - use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone's reach while doing the most important work of your career.

About The Team

Abuse Control Engineering (ACE) is Stripe's rapid-response technical defense and control incubator. When urgent abuse vectors emerge, ACE uses real-world attacker telemetry to prototype, test, and deploy software safeguards before vulnerabilities can be exploited at scale. We partner closely with Fraud, Risk, Abuse Research, and Product Engineering to run rigorous experiments that balance effective risk mitigation with legitimate user activity and conversion. Operating as both a strike team and an incubator, ACE builds automated regression suites to prevent threats from recurring and transfers mature controls to long-term product owners across Stripe.

What you'll do

As an Abuse Control Engineer on the ACE team, you will design, prototype, and incubate technical defenses that safeguard Stripe's financial ecosystem against complex, cross-cutting abuse vectors. When emerging threat patterns reveal weaknesses in Stripe products, ACE rapidly builds and experiments with technical safeguards. Guided by empirical evidence and Stripe's Fraud Taxonomy 3.0 (FT3) framework, you will translate threat intelligence into precise technical control requirements, such as API rate limits, step‑up challenges, parameter validation, and pre‑debit holds. You will run experiments to evaluate risk reduction against the impact on legitimate user conversion, carefully balancing security and product velocity. You will manage controls through a structured incubation lifecycle, build automated regression suites to prevent threats from recurring, and partner with product engineering teams to transfer mature, long-term defenses.

Responsibilities

• Rapid control prototyping: Design, prototype, and deploy technical controls across API, protocol, and product boundaries to address high-impact abuse vectors.
• Evidence-based technical requirements: Translate empirical attacker evidence and FT3 threat research from Abuse Research, Fraud, and Security teams into precise technical abuse requirements and control specifications.
• Control co-design: Collaborate with teams across Stripe to design resilient, secure controls across payments, onboarding, identity, and Connect surfaces.
• Risk experimentation: Run rigorous experiments and A/B tests to measure risk reduction against the impact on legitimate user conversion, optimizing controls to minimize friction while neutralizing threats.
• Regression testing: Build comprehensive regression test suites and automated attack simulations with Abuse Research to ensure mitigated abuse vectors do not recur.
• Stakeholder management: Execute ACE's incubation model by defining handoff criteria, operational documentation, timelines, and target dates for transferring successful controls to product teams.

Who you are

We're looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement.

Minimum Requirements

• 10+ years of experience in security engineering, software engineering, application security, or anti-abuse engineering in a high-scale production environment.
• A bachelor's or master's degree in computer science, cybersecurity, software engineering, or a related technical field, or equivalent practical experience.
• A strong software development background, with proficiency in Python, Go, Java, or a similar production programming language, as well as advanced SQL skills for analyzing system telemetry.
• Experience using frontier AI models for software development, learning, and analysis.
• Hands‑on experience building API-level safeguards, rate‑limiting frameworks, authentication or authorization checks, or input‑validation controls.
• Experience with automated testing frameworks, including writing unit, integration, and regression tests for critical backend software.
• Strong cross‑functional collaboration and communication skills, with a track record of partnering across security, product, and platform teams to drive technical outcomes.

Preferred Qualifications

• A track record of designing and executing A/B tests, evaluating control efficacy, and balancing security safeguards against user conversion friction.
• Expertise in threat modeling, secure systems architecture, and modern application‑security design principles.
• Familiarity with established threat frameworks, such as FT3 or MITRE ATT&CK, and experience applying adversary kill‑chain analysis to build resilient defenses.
• Knowledge of financial fraud vectors, threat‑actor tactics, techniques, and procedures, and attacker infrastructure, including account takeover, card testing, and credential stuffing.
• Hands‑on experience with large‑scale data‑processing platforms, such as Databricks, Trino, or PySpark, to monitor and measure control performance across distributed systems.
• Experience incubating software features, establishing clear operational handoff criteria, and transitioning ownership to partner engineering teams.

In-office expectations

Office‑assigned Stripes in most of our locations are currently expected to spend at least 50% of the time in a given month in their local office or with users. This expectation may vary depending on role, team and location. For example, Stripes in Stripe Delivery Center roles in Mexico City, Mexico, Bengaluru, India, and Dublin, Ireland work 100% from the office. Also, some teams have greater in‑office attendance requirements, to appropriately support our users and workflows, which the hiring manager will discuss. This approach helps strike a balance between bringing people together for in‑person collaboration and learning from each other, while supporting flexibility when possible.

Pay and benefits

The annual salary range for this role in the primary location is €132,000 - €198,000. This range may change if you are hired in another location. For sales roles, the range provided is the role's On Target Earnings (OTE) range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. This salary range may be inclusive of several career levels at Stripe and will be narrowed during the interview process based on a number of factors, including the candidate's experience, qualifications, and specific location. Applicants interested in this role and who are not located in the primary location may request the annual salary range for their location during the interview process.

Specific benefits and details about what compensation is included in the salary range listed above will vary depending on the applicant's location and can be discussed in more detail during the interview process. Benefits/additional compensation for this role may include: equity, company bonus or sales commissions/bonuses; retirement plans; health benefits; and wellness stipends.

We look forward to hearing from you.

At Stripe, we're looking for people with passion, grit, and integrity. You're encouraged to apply even if your experience doesn't precisely match the job description. Your skills and passion will stand out - and set you apart - especially if your career has taken some extraordinary twists and turns. At Stripe, we welcome diverse perspectives and people who think rigorously and aren't afraid to challenge assumptions. Join us.