Tech Stack
Tag name is followed by "@" symbol and proficiency level value.
About proficiency levels:
- 1-2 — basic awareness. Minimal hands-on experience, and a rudimentary understanding of the technology's purpose;
- 3-6 — daily use. Comfortable and regular usage, capable of handling common tasks and challenges related to the technology;
- 7-9 — you are an expert, you can teach others, you know all the pitfalls and tricks;
- 10 — exceptional knowledge, comprehensive understanding, and adeptness in all aspects of the technology, including advanced problem-solving. Think twice before claiming or demanding such level.
Agentic Systems
Communication @ 7
Data Pipelines
Go
Java
Mentoring @ 4
Payments
Python
Ruby
Security @ 4
- 1-2 — basic awareness. Minimal hands-on experience, and a rudimentary understanding of the technology's purpose;
- 3-6 — daily use. Comfortable and regular usage, capable of handling common tasks and challenges related to the technology;
- 7-9 — you are an expert, you can teach others, you know all the pitfalls and tricks;
- 10 — exceptional knowledge, comprehensive understanding, and adeptness in all aspects of the technology, including advanced problem-solving. Think twice before claiming or demanding such level.
Details
Who We Are
About Stripe
Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world's largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Stripe's mission is to increase the GDP of the internet.
About the Team
The Vulnerability Management team’s mission is to surface vulnerabilities at scale across Stripe. The team works to create a culture of continuous excellence in managing vulnerabilities, enhance customer trust by providing context about threats affecting Stripe's systems, and provide visibility into vulnerabilities across Stripe's products and services.
What You'll Do
Build systems that identify and prioritize vulnerabilities across Stripe's codebases, production infrastructure, and employee laptops. These systems collect software bills of materials (SBOMs) across tens of millions of lines of code, scan hundreds of thousands of hosts for package and kernel versions, and connect that inventory to known vulnerabilities (CVEs).
Build agentic systems to investigate emerging threats, including parsing breaking security news, identifying the technologies involved, and determining whether Stripe is affected.
Help teams across Stripe understand their exposure, prioritize fixes, and drive remediation. The role combines building data pipelines and security automation with hands-on vulnerability analysis and security guidance for partner teams.
Since the systems interact with the entire Stripe codebase, the role involves working in Go, Java, Ruby, and Python. The services owned by the team are written in Go, so most hands-on work will be in Go. The typical balance is approximately 70% coding and 30% reasoning about security issues or providing guidance to partner teams.
Responsibilities
- Identify vulnerabilities using automated tools and triage them appropriately.
- Collaborate with other teams to drive vulnerability remediation.
- Contribute to Stripe's overall security and risk management strategy.
- Continuously improve Stripe's security posture, processes, and tools.
Requirements
Minimum Requirements
- 5+ years of industry software engineering experience, excluding internships and co-ops.
- Significant software engineering experience within the security domain.
- Empathy, strong communication skills, and a deep respect for collaboration.
- Excellent problem-solving skills and attention to detail.
- High standards for code quality and a constructive attitude that helps others raise the bar.
- Experience mentoring early-career engineers in security and software engineering practices.
Preferred Qualifications
- Ability to think creatively and holistically about reducing risk in a complex environment.
- Familiarity with automated vulnerability identification tools and triage.
- Experience delivering successful projects using agents to automate human review processes.