Offensive Security Engineer, Penetration Testing

Stripe; United States; Remote; USD 170,000 - 256,000; Full time

Job summary

Stripe is seeking an Offensive Security Engineer to enhance the security of its innovative financial platform. In this role, you will simulate adversarial behaviors to identify vulnerabilities before product launches. Join a dynamic team focused on ensuring the security of Stripe's offerings while mentoring junior members and staying updated on the latest threats.

Benefits

Equity options

401(k) plan

Healthcare benefits

Wellness stipends

Qualifications

• 5+ years experience in offensive security and penetration testing.
• Proven knowledge of OWASP Top 10 vulnerabilities.
• Excellent communication skills for non-technical stakeholders.

Responsibilities

• Conduct offensive security assessments on web applications and APIs.
• Develop testing methodologies and tools for security assessments.
• Mentor junior team members and produce clear reports on findings.

Skills

Web application security

Python

Ruby

GoLang

Creative problem solving

Education

5+ years in offensive security or related field

Tools

Burp Suite

OWASP ZAP

Job description

Offensive Security Engineer, Penetration Testing

Join to apply for the Offensive Security Engineer, Penetration Testing role at Stripe

Offensive Security Engineer, Penetration Testing

Join to apply for the Offensive Security Engineer, Penetration Testing role at Stripe

Get AI-powered advice on this job and more exclusive features.

About Stripe

Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career.

About Stripe

Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career.

About The Team

The Proactive Threat team is responsible for offensive security assessments and penetration testing focused on product security. We proactively identify vulnerabilities in Stripe's web applications, APIs, and innovative technologies like AI/LLM before they impact our users or the business. The team is distributed with members primarily working in the United States, and we collaborate with teams across the globe to ensure a secure environment for Stripe and our products.

What you’ll do

As an Offensive Security Engineer, your primary responsibility will be to simulate the behaviors and techniques of real-world adversaries to identify and mitigate security risks in Stripe's offerings. You will lead engagements, apply advanced testing methodologies, and provide actionable insights to product teams to ensure a robust security posture prior to product launches.

Responsibilities

• Conduct comprehensive offensive security assessments across various environments, including web applications, APIs, and other technical products, while providing technical expertise in network protocols, operating systems, and web application security.
• Develop and utilize custom testing methodologies, scripts, and tools to enhance offensive security workflows.
• Identify nuanced vulnerabilities and develop mitigation strategies to safeguard Stripe’s services and operations.
• Collaborate effectively with fellow security team members and cross-functional teams to identify and mitigate security risks and vulnerabilities, driving improvements in the security of our products.
• Lead offensive security projects and mentor junior team members, fostering a culture of continuous learning and development within the team.
• Produce clear and concise reports on assessment findings, including testing plans, engagement models, risks, and actionable remediation recommendations.
• Stay up-to-date with the latest security threats, vulnerabilities, and attack methods, acting as the subject-matter expert and primary contact for stakeholder teams invested in offensive security programs and Stripe-wide security initiatives.
• Champion quality standards within the team, ensuring best practices are implemented and maintained.
  
  
  

Who you are

We’re looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement.

Minimum Requirements

• 5+ years of experience in offensive security, penetration testing, or a related field.
• Proven knowledge of web application security vulnerabilities, including OWASP Top 10 and ASVS.
• Experience with cloud platforms such as AWS, Azure, or Google Cloud.
• Proficiency in programming languages such as Python, Ruby, and GoLang, along with script development for automation.
• Familiarity with web security testing tools like Burp Suite, OWASP ZAP, and similar solutions.
• Excellent written and verbal communication skills, with the ability to produce concise reports that clearly communicate complex technical information to non-technical stakeholders.
• Ability to think creatively and approach problem-solving with a holistic view of risk in complex environments.
  
  
  

Preferred Qualifications

• Experience conducting offensive security in the fintech or financial sectors, or relevant security consulting experience.
• Familiarity with exploiting vulnerabilities and conducting vulnerability research, including CVE assignments.
• Certifications such as PNPT, BSCP, OSCP, CPTS, OSWE, OSCE, OSEP, OSED, CRTO, cloud certifications, and similar.
• Contributions to open-source security projects or active participation in the security community (e.g., writing blogs, presenting at conferences).
• Ability to lead critical projects independently while thriving in a fast-paced, dynamic work environment.
  
  
  

Working remotely at Stripe

A remote location, in most cases, is defined as being 35 miles (56 kilometers) or more from one of our offices. While you would be welcome to come into the office for team/business meetings, on-sites, meet-ups, and events, our expectation is you would regularly work from home rather than a Stripe office. Stripe does not cover the cost of relocating to a remote location. We encourage you to apply for roles that match the location where you currently or plan to live.

Pay and benefits

The annual US base salary range for this role is $170,400 - $255,700. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. This salary range may be inclusive of several career levels at Stripe and will be narrowed during the interview process based on a number of factors, including the candidate’s experience, qualifications, and location. Applicants interested in this role and who are not located in the US may request the annual salary range for their location during the interview process.

Additional benefits for this role may include: equity, company bonus or sales commissions/bonuses; 401(k) plan; medical, dental, and vision benefits; and wellness stipends.

Seniority level

• Seniority level

  Mid-Senior level

Employment type

• Employment type

  Full-time

Job function

• Job function

  Information Technology

• Industries

  Software Development, Financial Services, and Technology, Information and Internet

Referrals increase your chances of interviewing at Stripe by 2x

United States $177,000 - $251,000 2 days ago

Security Software Engineer (L5), Detection Engineering

United States $190,000 - $920,000 2 weeks ago

United States
$140,000.00
-
$160,000.00
4 days ago

Dublin, OH
$69,000.00
-
$117,000.00
1 week ago

Security Engineer, Vulnerability Response

Security Engineer with Cloud Operations - 100% Remote

Washington, DC
$110,000.00
-
$165,000.00
6 months ago

Senior Security Engineer, Infrastructure Security

United States
$135,000.00
-
$175,000.00
10 hours ago

Pennsylvania, United States
$67,500.00
-
$126,000.00
2 weeks ago

United States
$213,000.00
-
$293,000.00
1 week ago

Colchester, VT
$120,000.00
-
$155,000.00
2 months ago

Senior Security Engineer, Detection & Response

United States $122,400 - $195,500 1 week ago

Security Engineer II - CrowdStrike NG SIEM

United States $135,000 - $175,000 1 year ago

We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI.