Lead Fraud & Abuse Incident Response

Socket.dev; Seattle (WA); On-site; USD 180,000 - 230,000; Full time

Job summary

Stripe is seeking an experienced Incident Response Manager to join Abuse Operations in Seattle. You will lead end-to-end fraud and abuse incident response, coordinate cross-functional teams, and drive improvements to detection and remediation processes.

In this role you will develop runbooks, mentor teammates, and manage high-risk cases (ATO, card testing) in a fast-paced fintech environment, ensuring timely, accurate incident resolution.

Qualifications

• 10+ years of experience leading security or fraud incident response.
• B.S./M.S. in Computer Science or equivalent experience.
• Expert knowledge of Python and SQL, and familiarity with other programming languages
• Existing experience with log analysis (e.g. first or third party applications, system / data access, event logs), network security, digital forensics, and incident response investigations
• Proven ability to build automated response workflows, leverage threat intelligence, and make risk mitigation recommendations.
• Strong written and verbal communication skills with a track record of driving cross-functional alignment with minimal oversight.

Responsibilities

• Lead fraud and abuse incident response end-to-end as Incident Response Manager (IRM), coordinating workstreams, investigating high risk activity and accounts, and making actionable mitigation recommendations under pressure.
• Investigate, mitigate, and remediate urgent fraud incidents (e.g., ATO, card testing), utilizing FT3-mapped (Fraud Taxonomy 3.0) detection and signals enrichment to reduce uncertainty and accelerate response.
• As part of incidents, analyze high-risk accounts to identify fraudulent merchants, card testing, account takeovers, and other fraud vectors, classifying them using FT3 to standardize threat intelligence.
• Develop, document, and execute incident response strategies, runbooks, and capabilities to continuously improve fraud and abuse detection and prevention.
• Partner cross-functionally with security, data science, legal, and policy teams to build agentic response solutions, refine KPIs, and deliver clear incident reporting.
• Mentor teammates, lead key incident response engineering projects, and elevate quality standards across the team.

Skills

Python

SQL

Incident response

Log analysis

Automation workflows

Communication

Education

B.S./M.S. in Computer Science

Equivalent experience

Tools

Databricks

Trino

PySpark

Pandas

Sci-kit Learn

Job description

Stripe is seeking an experienced Incident Response Manager to join Abuse Operations in Seattle. You will lead end-to-end fraud and abuse incident response, coordinate cross-functional teams, and drive improvements to detection and remediation processes.

In this role you will develop runbooks, mentor teammates, and manage high-risk cases (ATO, card testing) in a fast-paced fintech environment, ensuring timely, accurate incident resolution.