Security Engineer, ACE

Details

Stripe is a financial infrastructure platform used by businesses worldwide.

Abuse Control Engineering (ACE) is Stripe’s rapid-response technical defense and control incubator. When urgent abuse vectors emerge, ACE uses real attacker telemetry to prototype, test, and deploy software safeguards before vulnerabilities can be exploited at scale. The team partners with Fraud, Risk, Abuse Research, and Product Engineering to balance risk mitigation against legitimate user conversion, build automated regression suites, and transfer mature controls to long-term product owners.

As an Abuse Control Engineer, you will design, prototype, and incubate technical defenses that protect Stripe’s financial ecosystem against complex, cross-cutting abuse vectors. You will translate threat intelligence and empirical evidence into technical control requirements, run experiments to evaluate risk reduction, and build defenses across payment, onboarding, identity, and Connect surfaces.

Responsibilities

• Design, prototype, and deploy technical controls across API, protocol, and product boundaries to close high-impact abuse vectors.
• Translate attacker evidence and FT3 threat research from Abuse Research, Fraud, and Security into technical abuse requirements and control specifications.
• Collaborate with teams across Stripe to co-design resilient, secure controls across payment, onboarding, identity, and Connect surfaces.
• Run experiments and A/B tests to measure risk reduction against legitimate user conversion impact, optimizing controls to minimize friction while neutralizing threats.
• Build comprehensive regression-testing suites and automated attack simulations with Abuse Research.
• Define handoff criteria, operational documentation, and target dates to transfer successful controls to product teams.

Requirements

• At least 3 years of experience in Security Engineering, Software Engineering, Application Security, or Anti-Abuse Engineering in a high-scale production environment.
• A bachelor’s or master’s degree in Computer Science, Cybersecurity, Software Engineering, or a related technical field, or equivalent practical experience.
• Strong software development experience with expert proficiency in Python, Go, Java, or similar production languages, along with expert SQL skills for analyzing system telemetry.
• Hands-on experience building API-level safeguards, rate-limiting frameworks, authentication and authorization checks, or input-validation controls.
• Experience with automated testing frameworks, including unit, integration, and regression testing for critical backend software.
• Strong cross-functional collaboration and communication skills, with experience partnering across security, product, and platform teams.

Preferred Qualifications

• Experience designing and executing A/B tests, evaluating control efficacy, and balancing security safeguards against user-conversion friction.
• Expertise in threat modeling, secure system architecture, and modern application-security design principles.
• Familiarity with threat frameworks such as FT3 and MITRE ATT&CK, and with adversary kill-chain analysis.
• Domain knowledge of financial fraud vectors, threat actor tactics, techniques, and procedures, and attacker infrastructure, including Account Takeover, Card Testing, and Credential Stuffing.
• Experience with large-scale data-processing platforms such as Databricks, Trino, and PySpark.
• Experience incubating software features, establishing operational handoff criteria, and transitioning ownership to partner engineering teams.