Security Engineer

Details

About Stripe

Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Stripe’s mission is to increase the GDP of the internet.

About the Team

Abuse Control Engineering (ACE) is Stripe’s rapid-response technical defense and control incubator. When urgent abuse vectors emerge, ACE bridges the gap using real attacker telemetry to prototype, test, and deploy software safeguards before vulnerabilities can be exploited at scale. The team partners closely with Fraud, Risk, and Product Engineering to run rigorous experiments, balancing aggressive risk mitigation against legitimate user conversion.

ACE operates as both a strike team and an incubator. It builds automated regression suites in partnership with Abuse Research to permanently block threat recurrence and transfers mature controls to long-term product owners across Stripe.

Responsibilities

• Design, prototype, and deploy technical controls across API, protocol, and product boundaries to close high-impact abuse vectors.
• Translate empirical attacker evidence and FT3 threat research from Abuse Research, Fraud, and Security into precise technical abuse requirements and control specifications.
• Collaborate with teams across Stripe to co-design resilient, secure controls across payment, onboarding, identity, and Connect surfaces.
• Run rigorous experiments and A/B tests to measure risk reduction against legitimate user conversion impact, optimizing controls to minimize friction while neutralizing threats.
• Build comprehensive regression testing suites and automated attack simulations with Abuse Research to ensure mitigated abuse vectors do not recur.
• Execute ACE’s incubation model by defining handoff criteria, operational documentation, and target dates to transfer successful controls to product teams.

Requirements

Minimum Requirements

• 3+ years of experience in Security Engineering, Software Engineering, Application Security, or Anti-Abuse Engineering in a high-scale production environment.
• Bachelor’s or master’s degree in Computer Science, Cybersecurity, Software Engineering, or a related technical field, or equivalent practical experience.
• Strong software development background with expert proficiency in Python, Go, Java, or similar production languages, alongside expert SQL skills for analyzing system telemetry.
• Hands-on engineering experience building API-level safeguards, rate-limiting frameworks, authentication and authorization checks, or input validation controls.
• Demonstrated experience with automated testing frameworks, including writing unit, integration, and regression tests for critical backend software.
• Strong cross-functional collaboration and communication skills, with a track record of partnering across security, product, and platform teams to drive technical outcomes.

Preferred Qualifications

• Proven track record of designing and executing A/B tests, evaluating control efficacy, and balancing security safeguards against user conversion friction.
• Deep expertise in threat modeling, secure system architecture, and modern application security design principles.
• Familiarity with established threat frameworks such as FT3 and MITRE ATT&CK, and experience applying adversary kill chain analysis to build resilient defenses.
• Strong domain knowledge of financial fraud vectors, threat actor tactics, techniques, and procedures (TTPs), and attacker infrastructure, including account takeover, card testing, and credential stuffing.
• Hands-on experience with large-scale data processing platforms such as Databricks, Trino, and PySpark to monitor and measure control performance across distributed systems.
• Demonstrated capability in incubating software features, establishing clear operational handoff criteria, and transitioning ownership to partner engineering teams.