Incident Response Manager - Security

Details

Who We Are

About Stripe

Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Stripe’s mission is to increase the GDP of the internet.

About the Team

The Security Incident Response team triages and assesses the severity of incoming security alerts, responds with initial containment measures, and escalates incidents for further investigation and resolution. The team analyzes diverse data sources to identify potential threats, gathers requirements for operational enhancements to detection and response systems, and scales security processes.

The team responds to external attacks and insider threats, remediates incidents, and supports the incident postmortem process. It is distributed globally and coordinates with stakeholders in North America, Europe, and Asia.

Responsibilities

• Lead and coordinate security incident response activities and workstreams as the incident response manager.
• Analyze and investigate threats or activities occurring on client devices, maintaining confidentiality and documenting incident details.
• Make decisions and recommendations based on incident analysis and communicate context to stakeholders, including insights to identify, prevent, detect, and respond to anomalous or potentially malicious activity.
• Develop, document, and implement incident response strategies, runbooks, capabilities, and techniques.
• Work cross-functionally with security engineering and data science teams to build solutions for analyzing security event data at scale and protecting Stripe networks, systems, and data from threats.
• Strengthen KPIs and metrics for measuring response effectiveness and provide clear, consistent reporting to stakeholders.
• Continuously improve security processes and response capabilities by building relationships with stakeholders and collaborating with engineers and analysts.
• Mentor and develop teammates and champion quality standards within the team.
• Act as incident commander, collaborate with internal stakeholders, perform post-incident analysis and reporting, and continuously improve Stripe’s security engineering and incident response function.

Requirements

Minimum Requirements

• 5+ years of experience leading security incident response.
• B.S. or M.S. in Computer Science or a related field, or equivalent experience.
• Working knowledge of Python and SQL, with familiarity with other programming languages.
• Experience with log analysis, including first- or third-party applications, system and data access, and event logs.
• Experience with network security, digital forensics, and incident response investigations.
• Hands-on experience analyzing and responding to security events, including log analysis, query and analytics development, security troubleshooting, and correlation of complex data sets.
• Proficiency in developing and using novel analytical methods to automate response processes.
• Excellent written and verbal communication skills, a proactive approach to informing stakeholders, and the ability to operate with little oversight.
• Ability to identify trends, insights, and relationships between internal and external data and intelligence sources to make risk mitigation recommendations.

Preferred Qualifications

• Broad information security knowledge and experience, including endpoint, email, network, identity management, cloud security, vulnerability management, incident response, and threat intelligence.
• Experience with engineering, data processing, and analysis tools such as Databricks and Trino.
• Familiarity with network observability, security software, or data engineering solutions such as Chronicle, osquery, LogScale, and Splunk.