Security Engineer, Product & Production Infrastructure

Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career.

About the team

Security Business Enablement (SBE) is Stripe's commercial security function: the interface between Stripe's internal security program and its Go-to-Market organization. We make sure security and compliance requirements never block, delay, or devalue Stripe's deals.

This work is about customer trust: businesses entrust Stripe with critical financial infrastructure, and their security teams need confidence that Stripe meets rigorous standards before, during, and after the sale. We make that trust tangible with accurate, consistent evidence of Stripe's security posture.

We own security due diligence end to end: questionnaire response, compliance evidence, live security reviews, gap and exception management, contractual security exhibits, rapid response during industry-wide events, and executive briefings. We engage customers directly, up to CISO level, and equip sales teams to handle security conversations on their own.

Our scope is unusually broad: one assessment can span security, privacy, business continuity, and resilience, translating deep control detail into language procurement, legal, and a CISO can each act on. We are often the first team asked to represent emerging parts of Stripe's posture.

We work at the intersection of security, AI, and Go-to-Market. Our platform is built on authoritative grounding: answers are retrieved from a knowledge base we maintain and validate, not generated from first principles, so they are consistent and source-traceable. Our POC proved the concept and outgrew what agent builders alone can do; taking it to production quality is the engineering problem this role exists to solve.

What you’ll do

Responsibilities

Design, build, and scale an AI-powered platform that delivers validated answers to security questions on demand, for both the sales teams who ask them and the customers who need them, replacing inconsistent ad-hoc responses with consistent, source-traceable ones
Build the retrieval, content pipeline orchestration, and integration layers that off-the-shelf tooling cannot deliver, including support for multiple cloud environments and Stripe's full and growing product portfolio, so that answers stay accurate as Stripe's infrastructure and products evolve
Build automations that keep security content current as Stripe rapidly adopts new technologies and introduces new controls, including automated refresh and review cycles that route content to subject-matter experts and Legal for validation
Build the capability to manage industry-standard certifications and assessment frameworks, including the Shared Assessments SIG and the Cloud Security Alliance CAIQ
Build analytics and evaluation capabilities that measure and continuously improve the performance and coverage of the security content library
Extend the same platform and knowledge base to power a public and authenticated Trust Center, giving customers direct self-service access to Stripe's security, privacy, resilience, and compliance posture
Partner with security analysts and with Security, Privacy, Legal, and Compliance stakeholders to expand coverage across Stripe's full security surface area, and own the reliability and operational health of what you build

Who you are

We’re looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement.

Minimum requirements

2+ years of software engineering experience building production systems
Strong coding skills in any programming language (we understand new languages can be learned on the job so our interview process is language agnostic)
Comfort working with retrieval-augmented architectures, content pipelines, and AI/LLM integrations, or demonstrated ability to learn quickly in these areas
Experience building workflow automation, including scheduled jobs, approval routing, and multi-stakeholder review processes
Comfortable instrumenting systems and working with data to measure quality, coverage, and performance, then using those measurements to drive improvement
Experience creating projects from scratch, taking ownership, and driving work to completion with minimal supervision
Strong communication skills and the ability to collaborate effectively with non-engineering stakeholders (security analysts, sales teams, legal)
Seek out opportunities for impact and can execute in a complex, cross-functional environment

Preferred qualifications

Experience building AI-driven products or workflows, particularly retrieval-augmented generation (RAG) systems or knowledge management platforms
Experience building evaluation frameworks for AI systems, such as measuring retrieval quality, answer accuracy, or coverage gaps
Familiarity with cloud security concepts across AWS and/or Azure
Previous experience with security software engineering, compliance tooling, or GRC platforms
Familiarity with security assessment frameworks and standards such as the Shared Assessments SIG, Cloud Security Alliance CAIQ, SOC 2, PCI DSS, or ISO 27001
Experience with content management systems, structured content modeling, or documentation-as-code approaches
Experience building customer-facing or internal self-service tools at scale
Comfort working in a small team where individual contributions have outsized, visible impact