Security engineer in abuse control

Stripe, Inc.; United States; Remote; USD 147.000 - 221.000; Vollzeit

Benefits dieser Stelle

Equity

Bonus / Sales commissions

Retirement plans

Health benefits

Wellness stipends

Zusammenfassung

Stripe, Inc. ищет специалиста по безопасности и anti-abuse с опытом разработки на Python/Go/Java и сильными навыками анализа телеметрии. Требуется 10+ лет опыта и образование в CS/кибербезопасности.

Работа включает проектирование и внедрение API-защит, ограничителей скорости и валидации входа, с тесным взаимодействием с кросс-функциональными командами. Вакансия допускает офис или удалённую работу; предлагает конкурентный пакет льгот и компенсаций, включая equity и бонусы.

Qualifikationen

• 10+ лет опыта в security engineering, software engineering, application security или anti-abuse в крупной продакшн-среде.
• Cильный фоновый уровень разработки ПО; владение Python/Go/Java; продвинутые навыки SQL для анализа телеметрии.
• Опыт работы с фреймворками угроз и моделированием угроз, включая FT3/MITRE ATT&CK
• Опыт построения API-защиты, ограничителей скорости, проверок аутентификации/авторизации и валидации входа.

Aufgaben

• Design, prototype и deployment технических контролей на границах API, протоколов и продуктов.
• Перевод эмпирических данных об атаках в точные требования и спецификации контроля.
• Сотрудничество с командами Stripe для разработки устойчивых и безопасных контролей.
• Проведение A/B тестов и экспериментов для оценки снижения рисков без ухудшения конверсии.
• Разработка регрессионных тестов и автоматических симуляций атак совместно с Abuse Research.

Kenntnisse

Security engineering

Python/Go/Java

SQL

A/B testing

Threat modeling

Cross-functional collaboration

Ausbildung

Bachelor's or Master’s in CS/Cybersecurity/related field

Tools

Databricks

Trino

PySpark

Jobbeschreibung

Описание: Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career.

Задачи

Design, prototype, and deploy technical controls across API, protocol, and product boundaries to address high-impact abuse vectors. Translate empirical attacker evidence and FT3 threat research from Abuse Research, Fraud, and Security teams into precise technical abuse requirements and control specifications. Collaborate with teams across Stripe to design resilient, secure controls across payments, onboarding, identity, and Connect surfaces. Run rigorous experiments and A/B tests to measure risk reduction against the impact on legitimate user conversion, optimizing controls to minimize friction while neutralizing threats. Build comprehensive regression test suites and automated attack simulations with Abuse Research to ensure mitigated abuse vectors do not recur. Execute ACE’s incubation model by defining handoff criteria, operational documentation, timelines, and target dates for transferring successful controls to product teams.

Требования

10+ years of experience in security engineering, software engineering, application security, or anti-abuse engineering in a high-scale production environment. A bachelor’s or master’s degree in computer science, cybersecurity, software engineering, or a related technical field, or equivalent practical experience. A strong software development background, with proficiency in Python, Go, Java, or a similar production programming language, as well as advanced SQL skills for analyzing system telemetry. Experience using frontier AI models for software development, learning, and analysis. Hands-on experience building API-level safeguards, rate-limiting frameworks, authentication or authorization checks, or input-validation controls. Experience with automated testing frameworks, including writing unit, integration, and regression tests for critical backend software. Strong cross-functional collaboration and communication skills, with a track record of partnering across security, product, and platform teams to drive technical outcomes. Будет плюсом: A track record of designing and executing A/B tests, evaluating control efficacy, and balancing security safeguards against user conversion friction; Expertise in threat modeling, secure systems architecture, and modern application-security design principles; Familiarity with established threat frameworks, such as FT3 or MITRE ATT&CK, and experience applying adversary kill-chain analysis to build resilient defenses; Knowledge of financial fraud vectors, threat-actor tactics, techniques, and procedures, and attacker infrastructure, including account takeover, card testing, and credential stuffing; Hands-on experience with large-scale data-processing platforms, such as Databricks, Trino, or PySpark, to monitor and measure control performance across distributed systems; Experience incubating software features, establishing clear operational handoff criteria, and transitioning ownership to partner engineering teams.

Условия

This role is available either in an office or a remote location (35+ miles or 56+ km from a Stripe office). Office-assigned Stripes spend at least 50% of the time in a given month in their local office or with users. While you would be welcome to come into the office for team/business meetings, on-sites, meet-ups, and events, our expectation is you would regularly work from home rather than a Stripe office. Stripe does not cover the cost of relocating to a remote location. The annual salary range for this role in the primary location is €132,000 - €198,000. Benefits/additional compensation for this role may include:

• equity, company bonus or sales commissions/bonuses
• retirement plans
• health benefits
• and wellness stipends.