Security Engineer, Web Application Security

Stripe is a financial infrastructure platform for businesses. Millions of companies - from the world’s largest enterprises to the most ambitious startups - use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone's reach while doing the most important work of your career.

About the team

Stripe’s Financial Crimes Compliance Risk Oversight (FinCRO) team is looking for a U.S. Regulatory Compliance Lead for our Banking-as-a-Service (BaaS) business. You’ll own second-line oversight of Stripe’s U.S. BaaS products and bank-fintech partnerships. The work is practical and cross-functional: turn federal and state requirements and supervisory expectations into clear policies, controls, monitoring, evidence, and ownership.

What you’ll do

This role is focused on U.S. BaaS regulation. You’ll work across sponsor-bank and fintech responsibility mapping; BSA/AML and sanctions; consumer protection and fair lending; deposits and FDIC insurance representations; privacy, cybersecurity, incident response, and third-party risk; complaints and disputes; payment network and ACH rules; state money transmission and lending requirements; and regulatory exams, remediation, and change management.

Responsibilities

Own the second-line compliance framework for Stripe’s U.S. BaaS products (i.e., Capital, Issuing, and Treasury) and bank-fintech partnerships. Make sure responsibilities are clear across Stripe, sponsor banks, program managers, processors, and other partners.
Turn U.S. federal and state laws, guidance, enforcement actions, and supervisory expectations into practical policies, product requirements, controls, procedures, evidence standards, and monitoring.
Set and oversee controls for BSA/AML, customer identification and verification, customer due diligence and beneficial ownership, transaction monitoring, suspicious activity escalation, sanctions screening, and recordkeeping.
Oversee consumer and lending compliance for BaaS products, including UDAAP; Regulations E, Z, B, and DD; fair lending; FCRA; SCRA; FDCPA; complaints and disputes; adverse action; collections; marketing and disclosures; fees; account restrictions; and account closures.
Oversee deposit-product compliance, including FDIC insurance representations, Reg CC, pass-through insurance requirements, pooled or custodial structures, customer-level records, ledger integrity, reconciliation, and access to funds.
Define compliance expectations for privacy, cybersecurity, incident escalation, operational resilience, business continuity, data access, record retention, and an orderly wind-down of BaaS programs.
Provide second-line oversight on behalf of sponsor banks and other BaaS partners through risk assessments, due diligence, contract requirements, control testing, performance and complaint monitoring, issue management, and exit planning.
Review new U.S. BaaS products and material changes. Identify applicable obligations, control gaps, licensing implications, and launch conditions, then drive remediation to closure with clear owners.
Keep pace with U.S. BaaS regulatory developments and enforcement trends, assess what they mean for Stripe, and coordinate timely changes with first-line teams.
Help Stripe prepare for and respond to U.S. regulatory exams, supervisory engagements, audits, and formal commitments. Maintain defensible obligation mappings and evidence, identify gaps, and oversee remediation.
Work closely with Product, Legal, Risk, Engineering, Operations, Internal Audit, sponsor-bank teams, and other specialists. Clarify ownership, challenge control design and execution, and give leaders a clear view of risk and progress.

Who you are

We're looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply.

Minimum requirements

At least 7 years of experience in U.S. banking, fintech, or financial-services compliance, including substantial work with BaaS, bank-fintech partnerships, embedded finance, or deposit, card, payment, or lending products.
A deep understanding of the U.S. regulatory framework for BaaS and how responsibilities are divided among sponsor banks, fintechs, program managers, processors, and other service providers.
Hands-on expertise across several relevant areas, such as BSA/AML and sanctions, consumer financial protection, fair lending, deposit and FDIC insurance requirements, third-party risk, complaints and disputes, privacy and cybersecurity, ACH or card programs, and state money transmission or lending requirements.
A track record of turning complex U.S. legal and regulatory requirements into practical policies, product requirements, controls, procedures, monitoring, testing, and evidence.
Experience with the full compliance control lifecycle: assessing risk and obligations, designing and implementing controls, documenting decisions, testing or monitoring, managing issues, overseeing remediation, and reporting to governance forums.
Experience reviewing new products and material changes, as well as supporting regulatory change, licensing analysis, exams, audits, enforcement remediation, or commitments to regulators and Boards.
Sound judgment, especially when ownership, regulatory precedent, or operating boundaries are not clear. You know how to separate second-line oversight from first-line execution and still move the work forward.
The ability to influence and coordinate across Compliance, Legal, Product, Engineering, Risk, Operations, Internal Audit, sponsor banks, and senior stakeholders without relying on formal authority.
Clear, concise writing and strong documentation skills. You can explain complex BaaS requirements and control decisions to technical, business, governance, partner-bank, and regulatory audiences.

Originally posted on Himalayas

Job Description

Who we are

About Stripe

About the team

What you’ll do

Responsibilities

Own the second-line compliance framework for Stripe’s U.S. BaaS products (i.e., Capital, Issuing, and Treasury) and bank-fintech partnerships. Make sure responsibilities are clear across Stripe, sponsor banks, program managers, processors, and other partners.
Turn U.S. federal and state laws, guidance, enforcement actions, and supervisory expectations into practical policies, product requirements, controls, procedures, evidence standards, and monitoring.
Set and oversee controls for BSA/AML, customer identification and verification, customer due diligence and beneficial ownership, transaction monitoring, suspicious activity escalation, sanctions screening, and recordkeeping.
Oversee consumer and lending compliance for BaaS products, including UDAAP; Regulations E, Z, B, and DD; fair lending; FCRA; SCRA; FDCPA; complaints and disputes; adverse action; collections; marketing and disclosures; fees; account restrictions; and account closures.
Oversee deposit-product compliance, including FDIC insurance representations, Reg CC, pass-through insurance requirements, pooled or custodial structures, customer-level records, ledger integrity, reconciliation, and access to funds.
Define compliance expectations for privacy, cybersecurity, incident escalation, operational resilience, business continuity, data access, record retention, and an orderly wind-down of BaaS programs.
Provide second-line oversight on behalf of sponsor banks and other BaaS partners through risk assessments, due diligence, contract requirements, control testing, performance and complaint monitoring, issue management, and exit planning.
Review new U.S. BaaS products and material changes. Identify applicable obligations, control gaps, licensing implications, and launch conditions, then drive remediation to closure with clear owners.
Keep pace with U.S. BaaS regulatory developments and enforcement trends, assess what they mean for Stripe, and coordinate timely changes with first-line teams.
Help Stripe prepare for and respond to U.S. regulatory exams, supervisory engagements, audits, and formal commitments. Maintain defensible obligation mappings and evidence, identify gaps, and oversee remediation.
Work closely with Product, Legal, Risk, Engineering, Operations, Internal Audit, sponsor-bank teams, and other specialists. Clarify ownership, challenge control design and execution, and give leaders a clear view of risk and progress.

Who you are

We're looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply.

Minimum requirements

At least 7 years of experience in U.S. banking, fintech, or financial-services compliance, including substantial work with BaaS, bank-fintech partnerships, embedded finance, or deposit, card, payment, or lending products.
A deep understanding of the U.S. regulatory framework for BaaS and how responsibilities are divided among sponsor banks, fintechs, program managers, processors, and other service providers.
Hands-on expertise across several relevant areas, such as BSA/AML and sanctions, consumer financial protection, fair lending, deposit and FDIC insurance requirements, third-party risk, complaints and disputes, privacy and cybersecurity, ACH or card programs, and state money transmission or lending requirements.
A track record of turning complex U.S. legal and regulatory requirements into practical policies, product requirements, controls, procedures, monitoring, testing, and evidence.
Experience with the full compliance control lifecycle: assessing risk and obligations, designing and implementing controls, documenting decisions, testing or monitoring, managing issues, overseeing remediation, and reporting to governance forums.
Experience reviewing new products and material changes, as well as supporting regulatory change, licensing analysis, exams, audits, enforcement remediation, or commitments to regulators and Boards.
Sound judgment, especially when ownership, regulatory precedent, or operating boundaries are not clear. You know how to separate second-line oversight from first-line execution and still move the work forward.
The ability to influence and coordinate across Compliance, Legal, Product, Engineering, Risk, Operations, Internal Audit, sponsor banks, and senior stakeholders without relying on formal authority.
Clear, concise writing and strong documentation skills. You can explain complex BaaS requirements and control decisions to technical, business, governance, partner-bank, and regulatory audiences.

Originally posted on Himalayas

Job Description

Who we are

About Stripe

About the team

What you’ll do

Responsibilities

Own the second-line compliance framework for Stripe’s U.S. BaaS products (i.e., Capital, Issuing, and Treasury) and bank-fintech partnerships. Make sure responsibilities are clear across Stripe, sponsor banks, program managers, processors, and other partners.
Turn U.S. federal and state laws, guidance, enforcement actions, and supervisory expectations into practical policies, product requirements, controls, procedures, evidence standards, and monitoring.
Set and oversee controls for BSA/AML, customer identification and verification, customer due diligence and beneficial ownership, transaction monitoring, suspicious activity escalation, sanctions screening, and recordkeeping.
Oversee consumer and lending compliance for BaaS products, including UDAAP; Regulations E, Z, B, and DD; fair lending; FCRA; SCRA; FDCPA; complaints and disputes; adverse action; collections; marketing and disclosures; fees; account restrictions; and account closures.
Oversee deposit-product compliance, including FDIC insurance representations, Reg CC, pass-through insurance requirements, pooled or custodial structures, customer-level records, ledger integrity, reconciliation, and access to funds.
Define compliance expectations for privacy, cybersecurity, incident escalation, operational resilience, business continuity, data access, record retention, and an orderly wind-down of BaaS programs.
Provide second-line oversight on behalf of sponsor banks and other BaaS partners through risk assessments, due diligence, contract requirements, control testing, performance and complaint monitoring, issue management, and exit planning.
Review new U.S. BaaS products and material changes. Identify applicable obligations, control gaps, licensing implications, and launch conditions, then drive remediation to closure with clear owners.
Keep pace with U.S. BaaS regulatory developments and enforcement trends, assess what they mean for Stripe, and coordinate timely changes with first-line teams.
Help Stripe prepare for and respond to U.S. regulatory exams, supervisory engagements, audits, and formal commitments. Maintain defensible obligation mappings and evidence, identify gaps, and oversee remediation.
Work closely with Product, Legal, Risk, Engineering, Operations, Internal Audit, sponsor-bank teams, and other specialists. Clarify ownership, challenge control design and execution, and give leaders a clear view of risk and progress.

Who you are

We're looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply.

Minimum requirements

At least 7 years of experience in U.S. banking, fintech, or financial-services compliance, including substantial work with BaaS, bank-fintech partnerships, embedded finance, or deposit, card, payment, or lending products.
A deep understanding of the U.S. regulatory framework for BaaS and how responsibilities are divided among sponsor banks, fintechs, program managers, processors, and other service providers.
Hands-on expertise across several relevant areas, such as BSA/AML and sanctions, consumer financial protection, fair lending, deposit and FDIC insurance requirements, third-party risk, complaints and disputes, privacy and cybersecurity, ACH or card programs, and state money transmission or lending requirements.
A track record of turning complex U.S. legal and regulatory requirements into practical policies, product requirements, controls, procedures, monitoring, testing, and evidence.
Experience with the full compliance control lifecycle: assessing risk and obligations, designing and implementing controls, documenting decisions, testing or monitoring, managing issues, overseeing remediation, and reporting to governance forums.
Experience reviewing new products and material changes, as well as supporting regulatory change, licensing analysis, exams, audits, enforcement remediation, or commitments to regulators and Boards.
Sound judgment, especially when ownership, regulatory precedent, or operating boundaries are not clear. You know how to separate second-line oversight from first-line execution and still move the work forward.
The ability to influence and coordinate across Compliance, Legal, Product, Engineering, Risk, Operations, Internal Audit, sponsor banks, and senior stakeholders without relying on formal authority.
Clear, concise writing and strong documentation skills. You can explain complex BaaS requirements and control decisions to technical, business, governance, partner-bank, and regulatory audiences.

Originally posted on Himalayas

Job Description

Who we are

About Stripe

About the team

What you’ll do

Responsibilities

Own the second-line compliance framework for Stripe’s U.S. BaaS products (i.e., Capital, Issuing, and Treasury) and bank-fintech partnerships. Make sure responsibilities are clear across Stripe, sponsor banks, program managers, processors, and other partners.
Turn U.S. federal and state laws, guidance, enforcement actions, and supervisory expectations into practical policies, product requirements, controls, procedures, evidence standards, and monitoring.
Set and oversee controls for BSA/AML, customer identification and verification, customer due diligence and beneficial ownership, transaction monitoring, suspicious activity escalation, sanctions screening, and recordkeeping.
Oversee consumer and lending compliance for BaaS products, including UDAAP; Regulations E, Z, B, and DD; fair lending; FCRA; SCRA; FDCPA; complaints and disputes; adverse action; collections; marketing and disclosures; fees; account restrictions; and account closures.
Oversee deposit-product compliance, including FDIC insurance representations, Reg CC, pass-through insurance requirements, pooled or custodial structures, customer-level records, ledger integrity, reconciliation, and access to funds.
Define compliance expectations for privacy, cybersecurity, incident escalation, operational resilience, business continuity, data access, record retention, and an orderly wind-down of BaaS programs.
Provide second-line oversight on behalf of sponsor banks and other BaaS partners through risk assessments, due diligence, contract requirements, control testing, performance and complaint monitoring, issue management, and exit planning.
Review new U.S. BaaS products and material changes. Identify applicable obligations, control gaps, licensing implications, and launch conditions, then drive remediation to closure with clear owners.
Keep pace with U.S. BaaS regulatory developments and enforcement trends, assess what they mean for Stripe, and coordinate timely changes with first-line teams.
Help Stripe prepare for and respond to U.S. regulatory exams, supervisory engagements, audits, and formal commitments. Maintain defensible obligation mappings and evidence, identify gaps, and oversee remediation.
Work closely with Product, Legal, Risk, Engineering, Operations, Internal Audit, sponsor-bank teams, and other specialists. Clarify ownership, challenge control design and execution, and give leaders a clear view of risk and progress.

Who you are

We're looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply.

Minimum requirements

At least 7 years of experience in U.S. banking, fintech, or financial-services compliance, including substantial work with BaaS, bank-fintech partnerships, embedded finance, or deposit, card, payment, or lending products.
A deep understanding of the U.S. regulatory framework for BaaS and how responsibilities are divided among sponsor banks, fintechs, program managers, processors, and other service providers.
Hands-on expertise across several relevant areas, such as BSA/AML and sanctions, consumer financial protection, fair lending, deposit and FDIC insurance requirements, third-party risk, complaints and disputes, privacy and cybersecurity, ACH or card programs, and state money transmission or lending requirements.
A track record of turning complex U.S. legal and regulatory requirements into practical policies, product requirements, controls, procedures, monitoring, testing, and evidence.
Experience with the full compliance control lifecycle: assessing risk and obligations, designing and implementing controls, documenting decisions, testing or monitoring, managing issues, overseeing remediation, and reporting to governance forums.
Experience reviewing new products and material changes, as well as supporting regulatory change, licensing analysis, exams, audits, enforcement remediation, or commitments to regulators and Boards.
Sound judgment, especially when ownership, regulatory precedent, or operating boundaries are not clear. You know how to separate second-line oversight from first-line execution and still move the work forward.
The ability to influence and coordinate across Compliance, Legal, Product, Engineering, Risk, Operations, Internal Audit, sponsor banks, and senior stakeholders without relying on formal authority.
Clear, concise writing and strong documentation skills. You can explain complex BaaS requirements and control decisions to technical, business, governance, partner-bank, and regulatory audiences.

Originally posted on Himalayas