Staff Security Engineer, Abuse Control

Requirements

• 10+ years of experience in security engineering, software engineering, application security, or anti-abuse engineering in a high-scale production environment.
• A bachelor’s or master’s degree in computer science, cybersecurity, software engineering, or a related technical field, or equivalent practical experience.
• A strong software development background, with proficiency in Python, Go, Java, or a similar production programming language, as well as advanced SQL skills for analyzing system telemetry.
• Experience using frontier AI models for software development, learning, and analysis.
• Hands-on experience building API-level safeguards, rate-limiting frameworks, authentication or authorization checks, or input-validation controls.
• Experience with automated testing frameworks, including writing unit, integration, and regression tests for critical backend software.
• Strong cross-functional collaboration and communication skills, with a track record of partnering across security, product, and platform teams to drive technical outcomes.

Nice to Haves

• A track record of designing and executing A/B tests, evaluating control efficacy, and balancing security safeguards against user conversion friction.
• Expertise in threat modeling, secure systems architecture, and modern application-security design principles.
• Familiarity with established threat frameworks, such as FT3 or MITRE ATT&CK, and experience applying adversary kill-chain analysis to build resilient defenses.
• Knowledge of financial fraud vectors, threat-actor tactics, techniques, and procedures, and attacker infrastructure, including account takeover, card testing, and credential stuffing.
• Hands-on experience with large-scale data-processing platforms, such as Databricks, Trino, or PySpark, to monitor and measure control performance across distributed systems.
• Experience incubating software features, establishing clear operational handoff criteria, and transitioning ownership to partner engineering teams.

What You'll Be Doing

• Rapid control prototyping: Design, prototype, and deploy technical controls across API, protocol, and product boundaries to address high-impact abuse vectors.
• Evidence-based technical requirements: Translate empirical attacker evidence and FT3 threat research from Abuse Research, Fraud, and Security teams into precise technical abuse requirements and control specifications.
• Control co-design: Collaborate with teams across Stripe to design resilient, secure controls across payments, onboarding, identity, and Connect surfaces.
• Risk experimentation: Run rigorous experiments and A/B tests to measure risk reduction against the impact on legitimate user conversion, optimizing controls to minimize friction while neutralizing threats.
• Regression testing: Build comprehensive regression test suites and automated attack simulations with Abuse Research to ensure mitigated abuse vectors do not recur.
• Stakeholder management: Execute ACE’s incubation model by defining handoff criteria, operational documentation, timelines, and target dates for transferring successful controls to product teams.

Perks and Benefits

No perks and benefits information provided.