Security Incident Response Engineer

Stripe; United States; Hybrid; USD 144,000 - 217,000; Full time

Benefits offered by this job

Equity

Bonus

Sales commissions/bonuses

401(k) plan

Medical benefits

Dental benefits

Vision benefits

Wellness stipends

Job summary

Stripe is seeking a security analytics engineer for the Security Incident Response team. You will analyze threats on client devices, build detection models, and transform raw data into actionable signals to protect Stripe networks and data.

You will collaborate across security engineering and data science, lead projects, mentor others, and ensure fast incident response using UEBA, SIEM, SOAR, and forensics techniques.

Qualifications

• 3+ years analyzing large data sets for security purposes.
• BS/MS in CS or related field or equivalent experience.
• Expert Python and SQL; familiarity with other languages.
• Experience with log analysis, network security, forensics, and incident response investigations.
• Proficiency in developing analytical methods to build, automate, and improve detection/response systems.
• Ability to communicate results clearly and focus on impact.
• Creative, holistic thinking to reduce risk in a complex environment.

Responsibilities

• Analyze and investigate threats on client devices.
• Develop requirements for detection models and enhancements to existing systems.
• Collect, transform, and ingest raw data from disparate sources into threat detection pipelines.
• Streamline incident response capabilities with clear tooling and processes.
• Collaborate cross-functionally with security engineering and data science to analyze security events at scale.
• Provide actionable insights to identify, prevent, detect, and respond to malicious activity.
• Act as SME and primary contact for stakeholder teams in Security Analytics and Detection programs.
• Lead projects, mentor others, and champion quality standards within the team.

Skills

Python

SQL

Log analysis

Network security

Digital forensics

Incident response

Data analysis

Communication

Education

B.S. or M.S. Computer Science or related field

Tools

Databricks/Jupyter

Trino

PySpark

Pandas

Sci-kit Learn

osquery

Splunk/LogScale

Job description

About Stripe

Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career.

About Stripe

Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career.

About The Team

The Security Incident Response team works to analyze, investigate, and respond to threats before they impact Stripe’s business or users. From external attacks to insider threats, our goal is to respond with speed and precision, remediate, and support the incident postmortem process. The team is distributed, working across multiple AMER time zones, and will regularly coordinate with stakeholders in EMEA and APAC.

What you’ll do

You will leverage your security engineering experience to improve incident response capabilities at Stripe. With an emphasis on user and entity behavior analytics, as well as endpoint hardening, you will gain a deep understanding of Stripe’s systems, tooling, and workflows to be able to differentiate between legitimate and malicious activity. Using both threat intelligence and collected telemetry, you will guide and build Stripe-specific signals enrichment logic and incident response solutions that scale with our company. Lastly, your analytic capabilities will be critical during security incidents to reduce uncertainty, uncover root causes, and inform future prevention and detection mechanisms.

Responsibilities

• Analyze and investigate a broad range of threats or activities occurring on client devices
• Develop requirements for detection models and enhancements to existing systems
• Collect, transform, and ingest raw data from disparate sources into threat detection pipelines
• Streamline incident response capabilities, ensuring the tooling and processes are clear
• Work cross-functionally with security engineering and data science teams to build solutions for analyzing security events data at scale and protecting Stripe networks, systems, and data from threats
• Provide actionable insights to help identify, prevent, detect, and respond to anomalous or potentially malicious user and entity activity
• Act as the subject-matter expert and primary contact for stakeholder teams invested in Security Analytics and Detection programs as well as Stripe-wide security initiatives
• Collaborate effectively with teammates, leading projects, mentoring others, and developing and championing quality standards within the team

Minimum Requirements

• 3+ years experience analyzing large data sets to solve problems and/or building models with a behavioral approach to security
• B.S. or M.S. Computer Science or related field, or equivalent experience
• Expert knowledge of Python and SQL, and familiarity with other programming languages
• Existing experience with log analysis (e.g. first or third party applications, system / data access, event logs), network security, digital forensics, and incident response investigations
• Proficiency with developing and using novel analytical methods to build, automate, and improve detection and response systems
• Ability to communicate results clearly and focus on impact
• Ability to think creatively and holistically about reducing risk in a complex environment

Preferred Qualifications

• An adversarial mindset, understanding the goals, behaviors, and TTPs of threat actors.
• Experience with software engineering, data processing and analysis tools (e.g. Databricks/Jupyter, Trino, etc.)
• Familiarity with common open-source frameworks for big data processing and/or data science (PySpark, Pandas, Sci-kit Learn, etc.)
• Experience with tactical threat intelligence and/or hunting for sophisticated threat actors in an enterprise environment
• Familiarity with network observability, security software, or data engineering solutions (osquery, Splunk/LogScale, etc.)
• Experience in one or more of the following areas: user and entity behavior analytics (UEBA), security information event management (SIEM), security orchestration automation and response (SOAR), or data loss prevention (DLP)

Hybrid work at Stripe

This role is available either in an office or a remote location (35+ miles or 56+ km from a Stripe office).

In-office expectations

Office-assigned Stripes spend at least 50% of the time in a given month in their local office or with users. This hits a balance between bringing people together for in-person collaboration and learning from each other, while supporting flexibility about how to do this in a way that makes sense for individuals and their teams.

Working remotely at Stripe

A remote location is defined as being 35 miles (56 kilometers) or more from one of our offices. While you would be welcome to come into the office for team/business meetings, on-sites, meet-ups, and events, our expectation is you would regularly work from home rather than a Stripe office. Stripe does not cover the cost of relocating to a remote location. We encourage you to apply for roles that match the location where you currently live or plan to live.

Pay and benefits

The annual US base salary range for this role is $144,300 - $216,500. For sales roles, the range provided is the role’s On Target Earnings (\"OTE\") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. This salary range may be inclusive of several career levels at Stripe and will be narrowed during the interview process based on a number of factors, including the candidate’s experience, qualifications, and location. Applicants interested in this role and who are not located in the US may request the annual salary range for their location during the interview process.

Additional benefits for this role may include: equity, company bonus or sales commissions/bonuses; 401(k) plan; medical, dental, and vision benefits; and wellness stipends.

We look forward to hearing from you.

At Stripe, we're looking for people with passion, grit, and integrity. You're encouraged to apply even if your experience doesn't precisely match the job description. Your skills and passion will stand out—and set you apart—especially if your career has taken some extraordinary twists and turns. At Stripe, we welcome diverse perspectives and people who think rigorously and aren't afraid to challenge assumptions. Join us.