ARG Engineering Manager

Stripe; South San Francisco (CA); On-site; USD 350,000 - 520,000; Full time

Job summary

Stripe is seeking a senior leader to head the Abuse Research Group in South San Francisco. You will guide threat intelligence, fraud investigations, and detection engineering across Stripe products.

You will hire, mentor, and scale a high-performance team while collaborating with Risk, Trust & Safety, Fraud Platform, and Security Engineering to drive proactive protections. You will address API key takeovers, account compromises, and KYC bypass techniques.

Qualifications

• 10+ years leading security engineering or research teams.
• Experience recruiting, growing, and leading technical teams.
• Excellent written and verbal communication for leadership
• Familiarity with payments and fintech fraud patterns
• Hands-on threat intelligence tradecraft: OSINT, dark web collection, actor attribution, and structured intelligence frameworks (ATT&CK, STIX/TAXII)
• Strong understanding of threat actor TTPs

Responsibilities

• Lead the Abuse Research Group and set the research agenda across threat actor tracking, fraud investigations, merchant ecosystem defense, and automated detection engineering
• Scale the team through hiring, coaching, and mentoring individual contributors
• Operationalize research findings into production-level detection rules and automated responses
• Collaborate with Risk, Trust & Safety, Fraud Platform, and Security Engineering to translate abuse research into proactive platform protections
• Coordinate with external stakeholders, including law enforcement, to disrupt and attribute high-impact threat actors
• Coach and mentor team members to support career development while maintaining high technical standards

Skills

Threat intelligence

Security leadership

Fraud research

Detection engineering

Team building

OSINT

TTPs

Education

CS degree or security

Tools

ATT&CK/STIX

Job description

Who we are

About Stripe

Stripe is a financial infrastructure platform for businesses. Millions of companies - from the world’s largest enterprises to the most ambitious startups - use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone's reach while doing the most important work of your career.

About the team

The Abuse Research team is dedicated to proactively hunting for emerging abuse vectors and studying complex attacker behaviors. Rather than just reacting to alerts, the team maps complete abuse paths across Stripe products and external systems to validate novel findings and explain the underlying product conditions that enable fraud. By building continuous abuse tests with agentic testing and related systems, they translate their deep research into actionable threat advisories, strategic control recommendations, and regression scenarios that fortify Stripe’s defenses.

What you’ll do

You will lead the Abuse Research Group (ARG)—a team of threat intelligence analysts, fraud researchers, and detection engineers focused on proactively identifying and mitigating threats to Stripe and our merchants. You will set the research agenda, guiding work across threat actor tracking, hands-on fraud investigations, merchant ecosystem defense, and the detection pipelines that turn findings into production enforcement. You will scale the team through hiring, coaching, and talent development, while serving as a technical advisor on complex investigations. You will also own ARG's relationships with key partners—including Risk, Trust & Safety, Fraud Platform, and Security Engineering.

• Lead, develop, and retain a team of threat intelligence analysts, fraud researchers, and detection engineers who thrive at the intersection of adversarial research and engineering
• Set and execute the research agenda across threat actor tracking, fraud investigation, merchant ecosystem defense, and automated detection engineering
• Provide technical depth and analytical judgment on complex investigations, including API key takeovers, account compromise campaigns, and KYC bypass techniques
• Operationalize research findings into production-level detection rules, automated response mechanisms, and cross-functional escalations
• Collaborate with Risk, Trust & Safety, Fraud Platform, and Security Engineering to translate abuse research into proactive platform protections
• Coordinate with external stakeholders, including law enforcement, to disrupt and attribute high-impact threat actors
• Coach and mentor individual contributors to support their career development while maintaining high technical standards

Who you are

We're looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement.

Minimum requirements

• 10+ years of experience leading security engineering or research teams, with a track record of managing technical ICs doing investigative, intelligence, or detection work.
• B.S. or M.S. Computer Science or related field, or equivalent experience in Security
• Experience recruiting, growing, and leading technical teams, including performance management
• Excellent written and verbal communication skills, including the ability to develop and deliver operational or incident-related information to leadership
• Familiarity with fraud and abuse patterns specific to payments and fintech
• Hands-on experience with threat intelligence tradecraft: OSINT, dark web collection, actor attribution, and working with structured intelligence frameworks (ATT&CK, STIX/TAXII, or equivalent)
• Strong understanding of threat actor tactics, techniques, and procedures (TTPs)

Preferred qualifications

• Background in security research, threat intelligence, or fraud detection engineering — prior experience leading or working in teams that study adversary behavior, build detection systems, or operate intelligence programs; experience in payments, fintech, or financial crime is a strong plus. ^
• Technical fluency across the domains ARG works in — threat intelligence, fraud signal development, detection engineering, and OSINT. ^
• Experience managing or growing technical research teams, ideally in a domain where the work is investigative, ambiguous, and doesn't map cleanly to sprint velocity.