Security Analyst

Details

Stripe is a financial infrastructure platform for businesses. The Security Incident Response team analyzes, investigates, and responds to threats before they impact Stripe's business or users. The team is distributed across North America, Europe, and Asia and regularly coordinates with stakeholders in different time zones.

The role analyzes and responds to security notifications, events, and inquiries. It performs initial triage of potential security incidents through log and data analysis, determines whether activity represents a valid threat, assesses severity and potential impact, takes pre-approved remediation measures, and escalates findings for further investigation. The role also supports threat-detection improvements, data enrichment, automation, and incident response processes.

Responsibilities

• Analyze and investigate activity on company devices and cloud infrastructure that could represent a security threat.
• Work cross-functionally with Security teams to develop solutions for analyzing security events at scale and protecting Stripe networks, systems, and data.
• Interpret disparate data sources to report on trends and support investigative requests.
• Collect requirements for enhancements to detection models and response systems.
• Leverage existing systems and data to perform analyses and promote process improvements.
• Provide actionable insights to identify, prevent, detect, and respond to anomalous or potentially malicious user activity.
• Collaborate with teammates, lead projects, mentor others, and develop and champion quality operational standards across the team.

Requirements

• 5+ years of experience in information technology or cybersecurity roles, including incident response.
• 2+ years of experience analyzing large data sets to solve problems or manage projects related to security event triage or workplace investigations.
• Experience investigating and triaging security threats on endpoint devices, including Mac, Linux, and Windows, and cloud infrastructure across AWS, Azure, and GCP.
• B.S. or M.S. in Cyber Security and Information Assurance, Data Analytics, Computer Science, or a related field, or equivalent experience.
• Working knowledge of SQL.
• Basic knowledge of scripting or programming in Python, Go, or other programming languages.
• Experience with log querying and analysis, digital forensics, or incident response using one or more industry-standard SIEM platforms, such as Splunk, Sentinel, Chronicle, or Elastic.
• Proficiency using analytical methods to inform detection systems or guide strategic response.
• Strong cross-functional collaboration and written and verbal communication skills.
• Ability to think creatively and holistically about identifying and reducing risk in a complex environment.
• High level of judgment, objectivity, and discretion.

Preferred Qualifications

• Experience working with high-volume data in a security incident response environment.
• Experience with data processing and analysis tools such as Jupyter Notebooks and Databricks.
• An adversarial mindset and understanding of threat actor goals, behaviors, and tactics, techniques, and procedures (TTPs).
• Ability to leverage threat intelligence or threat hunting concepts in an enterprise environment.
• Experience with user and entity behavior analytics (UEBA), SOAR/security automation, security information and event management (SIEM), data loss prevention (DLP), information security, or data privacy.
• One or more security certifications from a recognized industry provider, such as GIAC, ISACA, ISC2, OffSec, or CompTIA.