Threat Hunting Engineer — Abuse Research

Stripe; Atlanta (GA); On-site; USD 140,000 - 210,000; Full time

Job summary

Stripe is seeking an Abuse Research Engineer to proactively hunt for advanced threats, dissect fraud vectors, and extract actionable adversary intelligence. You will work across internal telemetry and external sources to uncover TTPs before they impact Stripe’s platform.

Responsibilities include kill chain analysis, FT3 taxonomy application, threat intelligence integration, and agentic testing to validate controls across Fraud, Risk, Onboarding, and Security teams.

Qualifications

• 5+ years in threat intelligence, threat hunting, or incident response.
• 5+ years analyzing large datasets to identify anomalies and fraud patterns.
• Degree in CS/Cybersecurity or equivalent experience.
• Proficiency in Python and SQL, automating workflows and data queries.
• Experience with log analysis and digital forensics.
• Strong ability to translate research into actionable recommendations.

Responsibilities

• Proactive threat hunting and kill chain analysis across Stripe systems.
• Apply FT3 taxonomy to standardize threat intelligence and kill chain phases.
• Integrate threat feeds into engineering workflows with cross-team collaboration.
• Translate research findings into advisories and control recommendations for stakeholders.
• Develop agentic testing workflows to simulate adversary TTPs and validate controls.

Skills

Threat hunting

Data analytics

Python

SQL

Communication

Education

B.S./M.S. in CS or Cybersecurity

Tools

Databricks

Trino

PySpark

Pandas

Scikit-Learn

Job description

Stripe is seeking an Abuse Research Engineer to proactively hunt for advanced threats, dissect fraud vectors, and extract actionable adversary intelligence. You will work across internal telemetry and external sources to uncover TTPs before they impact Stripe’s platform.

Responsibilities include kill chain analysis, FT3 taxonomy application, threat intelligence integration, and agentic testing to validate controls across Fraud, Risk, Onboarding, and Security teams.