SalariesSign in
AboutPrivacyTerms
Security Engineer
Stripe

Security Engineer

United StatesRemoteFull-time
Posted Sep 13
Apply

Job Description

Who we are

About Stripe

Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career.

About the team

Abuse Control Engineering (ACE) is Stripe’s rapid-response technical defense and control incubator. When urgent abuse vectors emerge, ACE bridges the gap using real attacker telemetry to prototype, test, and deploy software safeguards before vulnerabilities can be exploited at scale. We partner closely with Fraud, Risk and Product Engineering to run rigorous experiments, balancing aggressive risk mitigation against legitimate user conversion. Operating as both a strike team and an incubator, ACE builds automated regression suites in partnership with Abuse Research to permanently block threat recurrence and seamlessly transfers mature controls to long-term product owners across Stripe.

What you’ll do

As an Abuse Control Engineer on the Abuse Control Engineering (ACE) team, you will design, prototype, and incubate technical defenses that safeguard Stripe’s financial ecosystem against complex, cross-cutting abuse vectors.

Where emerging threat patterns identify Stripe product weaknesses, ACE steps in to rapidly build and experiment with technical safeguards. Driven by empirical evidence and Stripe’s FT3 (Fraud Taxonomy 3.0) framework, you will translate threat intelligence into hard technical control requirements (e.g., API rate-limiting, step-up challenges, parameter validation, pre-debit holds). You will carefully balance security and product velocity, running experiments to evaluate risk reduction against user conversion impact. Managing controls through a strict incubation lifecycle, you will build automated regression suites to prevent recurrence and partner with native product teams to hand off mature, long-term defenses.

Responsibilities

  • Rapid Control Prototyping: Design, prototype, and deploy technical controls across API, protocol, and product boundaries to immediately close high-impact abuse vectors. Evidence-Based Technical Requirements: Translate empirical attacker evidence and FT3 threat research Abuse Research, Fraud and Security into precise technical abuse requirements and control specifications.
  • Control Co-Design: Collaborate closely with teams across Stripe to co-design resilient, secure controls across payment, onboarding, identity, and Connect surfaces.
  • Risk Experimentation: Run rigorous experiments and A/B tests to measure risk reduction against legitimate user conversion impact, optimizing controls to minimize friction while neutralizing threats.
  • Regression Testing: Build comprehensive regression testing suites and automated attack simulations with Abuse Research to ensure mitigated abuse vectors do not recur.
  • Stakeholder Management: Execute ACE’s incubation model by defining handoff criteria, operational documentation, and target dates to transfer successful controls to product teams.

Who you are

We’re looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement.

Minimum requirements

  • 3+ years of experience in Security Engineering, Software Engineering, Application Security, or Anti-Abuse Engineering in a high-scale production environment.
  • B.S. or M.S. in Computer Science, Cybersecurity, Software Engineering, or a related technical field, or equivalent practical experience.
  • Strong software development background with expert proficiency in Python, Go, Java, or similar production languages, alongside expert SQL skills for analyzing system telemetry.
  • Hands-on engineering experience building API-level safeguards, rate-limiting frameworks, authentication/authorization checks, or input validation controls.
  • Demonstrated experience with automated testing frameworks, including writing unit, integration, and regression tests for critical backend software.
  • Strong cross-functional collaboration and communication skills, with a track record of partnering across security, product, and platform teams to drive technical outcomes.

Preferred qualifications

  • Proven track record of designing and executing A/B tests, evaluating control efficacy, and balancing security safeguards against user conversion friction.
  • Deep expertise in threat modeling, secure system architecture, and modern application security design principles.
  • Familiarity with established threat frameworks (e.g., FT3, MITRE ATT&CK) and applying adversary kill chain analysis to build resilient defenses.
  • Strong domain knowledge of financial fraud vectors, threat actor TTPs, and attacker infrastructure (e.g., Account Takeover, Card Testing, Credential Stuffing).
  • Hands-on experience with large-scale data processing platforms (e.g., Databricks, Trino, PySpark) to monitor and measure control performance across distributed systems.
  • Demonstrated capability in incubating software features, establishing clear operational handoff criteria, and seamlessly transitioning ownership to partner engineering teams.

Originally posted on Himalayas

View job

Security Architect

SQA Solution

  • United States
  • Remote
  • Full-time
Apply
19 hrs ago
View job
W

Technical Escalation & Incident Response Engineer

Wiz

  • New York City
Apply
Added 19 hrs ago
View job
S

Security Engineer, Bridge

Stripe

  • Luxembourg
Apply
Added 19 hrs ago
View job
O

Staff Product Security Engineer, Offensive Security Team

Okta

  • Dublin, Ireland
Apply
Added 19 hrs ago
View job
H

Manager, Security Operations Center

Huntress

  • United States of America
Apply
Added 19 hrs ago
View job
E

Senior Solution Architect Security Specialist

Elastic

  • Tokyo, Japan
Apply
Added 19 hrs ago
View job

Head of Information Security & Enterprise Risk Management

Filinvest Group

  • United States
  • Remote
  • Full-time
Apply
19 hrs ago
View job

Director of Security Operations

National Debt Relief, LLC.

  • United States
  • Remote
  • Full-time
Apply
20 hrs ago
View job

System and Security Engineer

IT Support Guy

  • United States
  • Remote
  • Full-time
Apply
20 hrs ago
View job

Senior Cybersecurity Project Manager – Security Tool Rationalization & Transform

Axiom Path

  • United States
  • Remote
  • Contract
Apply
21 hrs ago
View job
A

Consultant - Penetration Testing/Ethical Hacking (all genders)

Alice&Bob.Company

  • United States
  • Remote
  • Full-time
Apply
21 hrs ago
View job

AI Security Architect – Generative AI, LLM Security & AI Gateway Controls

Axiom Path

  • United States
  • Remote
  • Contract
Apply
21 hrs ago
View job

Head of IT Compliance

Arrise

  • Poland
  • Remote
  • Full-time
Apply
21 hrs ago
View job

Clear Skye IAM Engineer

Lacuna Talent

  • United Kingdom
  • Remote
  • Full-time
Apply
21 hrs ago
View job

IAM Federation Services (Okta) Engineer

Lifelancer

  • United States
  • Remote
  • Full-time
Apply
22 hrs ago
View job

Chief Information Security Officer (CISO) — Insurance & Investments

TheHiveCareers

  • Grenada
  • Remote
  • Full-time
Apply
23 hrs ago
View job

Penetration Tester Internship

NullNetwork Solutions

  • United States
  • Remote
  • Internship
Apply
23 hrs ago
View job

Chief Risk Officer (CRO) – Retail Banking

TheHiveCareers

  • Virgin Islands, British
  • Remote
  • Full-time
Apply
23 hrs ago
View job

Professional Services Red Team Intern - Summer 2027 (Remote, GBR)

Crowdstrike

  • United Kingdom
  • Remote
  • Internship
Apply
23 hrs ago
View job

IT GRC Analyst

GB.540 Houlihan Lokey UK Limited

  • United Kingdom
  • Remote
  • Full-time
Apply
1 day ago
View job

Junior Privacy Advisor

Secify

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

AI Red Team Specialist - Remote | Upto $22/hr

mercor

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Chief Information Security Officer (CISO) — Insurance & Investments

TheHiveCareers

  • Saint Vincent and the Grenadines
  • Remote
  • Full-time
Apply
1 day ago
View job

Director, Product Manager - Managed Security Services

VikingCloud

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Cybersecurity Architect

Lifelancer

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Security Support Specialist, Wirespeed

Coalition

  • United Kingdom
  • Remote
  • Full-time
Apply
1 day ago
View job

Communications Security Custodian (COMSEC) - Remote

F3EA, Inc.

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Cyber Security Analyst / Security Engineer

Elfonze Technologies

  • United States
  • Remote
  • Full-time
Apply
1 day ago
View job

Cybersecurity Intern

IT Support Guy

  • United States
  • Remote
  • Internship
Apply
1 day ago
View job

Software Engineer - Security

Board Intelligence

  • United Kingdom
  • Remote
  • Full-time
Apply
1 day ago
Page 1 of 127Next
Stripe

Security Engineer

United StatesRemoteFull-time
Posted Sep 13
Apply

Job Description

Who we are

About Stripe

Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career.

About the team

Abuse Control Engineering (ACE) is Stripe’s rapid-response technical defense and control incubator. When urgent abuse vectors emerge, ACE bridges the gap using real attacker telemetry to prototype, test, and deploy software safeguards before vulnerabilities can be exploited at scale. We partner closely with Fraud, Risk and Product Engineering to run rigorous experiments, balancing aggressive risk mitigation against legitimate user conversion. Operating as both a strike team and an incubator, ACE builds automated regression suites in partnership with Abuse Research to permanently block threat recurrence and seamlessly transfers mature controls to long-term product owners across Stripe.

What you’ll do

As an Abuse Control Engineer on the Abuse Control Engineering (ACE) team, you will design, prototype, and incubate technical defenses that safeguard Stripe’s financial ecosystem against complex, cross-cutting abuse vectors.

Where emerging threat patterns identify Stripe product weaknesses, ACE steps in to rapidly build and experiment with technical safeguards. Driven by empirical evidence and Stripe’s FT3 (Fraud Taxonomy 3.0) framework, you will translate threat intelligence into hard technical control requirements (e.g., API rate-limiting, step-up challenges, parameter validation, pre-debit holds). You will carefully balance security and product velocity, running experiments to evaluate risk reduction against user conversion impact. Managing controls through a strict incubation lifecycle, you will build automated regression suites to prevent recurrence and partner with native product teams to hand off mature, long-term defenses.

Responsibilities

  • Rapid Control Prototyping: Design, prototype, and deploy technical controls across API, protocol, and product boundaries to immediately close high-impact abuse vectors. Evidence-Based Technical Requirements: Translate empirical attacker evidence and FT3 threat research Abuse Research, Fraud and Security into precise technical abuse requirements and control specifications.
  • Control Co-Design: Collaborate closely with teams across Stripe to co-design resilient, secure controls across payment, onboarding, identity, and Connect surfaces.
  • Risk Experimentation: Run rigorous experiments and A/B tests to measure risk reduction against legitimate user conversion impact, optimizing controls to minimize friction while neutralizing threats.
  • Regression Testing: Build comprehensive regression testing suites and automated attack simulations with Abuse Research to ensure mitigated abuse vectors do not recur.
  • Stakeholder Management: Execute ACE’s incubation model by defining handoff criteria, operational documentation, and target dates to transfer successful controls to product teams.

Who you are

We’re looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement.

Minimum requirements

  • 3+ years of experience in Security Engineering, Software Engineering, Application Security, or Anti-Abuse Engineering in a high-scale production environment.
  • B.S. or M.S. in Computer Science, Cybersecurity, Software Engineering, or a related technical field, or equivalent practical experience.
  • Strong software development background with expert proficiency in Python, Go, Java, or similar production languages, alongside expert SQL skills for analyzing system telemetry.
  • Hands-on engineering experience building API-level safeguards, rate-limiting frameworks, authentication/authorization checks, or input validation controls.
  • Demonstrated experience with automated testing frameworks, including writing unit, integration, and regression tests for critical backend software.
  • Strong cross-functional collaboration and communication skills, with a track record of partnering across security, product, and platform teams to drive technical outcomes.

Preferred qualifications

  • Proven track record of designing and executing A/B tests, evaluating control efficacy, and balancing security safeguards against user conversion friction.
  • Deep expertise in threat modeling, secure system architecture, and modern application security design principles.
  • Familiarity with established threat frameworks (e.g., FT3, MITRE ATT&CK) and applying adversary kill chain analysis to build resilient defenses.
  • Strong domain knowledge of financial fraud vectors, threat actor TTPs, and attacker infrastructure (e.g., Account Takeover, Card Testing, Credential Stuffing).
  • Hands-on experience with large-scale data processing platforms (e.g., Databricks, Trino, PySpark) to monitor and measure control performance across distributed systems.
  • Demonstrated capability in incubating software features, establishing clear operational handoff criteria, and seamlessly transitioning ownership to partner engineering teams.

Originally posted on Himalayas