Requirements

• 10+ years of experience in security engineering, software engineering, application security, or anti-abuse engineering in a high-scale production environment.
• Bachelor’s or master’s degree in computer science, cybersecurity, software engineering, or a related technical field, or equivalent practical experience.
• Proficiency in Python, Go, Java, or similar production programming languages, plus advanced SQL skills for analyzing system telemetry.
• Experience using frontier AI models for software development, learning, and analysis.
• Hands-on experience building API-level safeguards, rate-limiting frameworks, authentication/authorization checks, or input-validation controls.
• Experience with automated testing frameworks, including unit, integration, and regression tests for backend software.
• Strong cross-functional collaboration and communication skills, with proven ability to partner across security, product, and platform teams.

Nice to haves

• Experience designing and executing A/B tests to evaluate control efficacy and balance security with user conversion.
• Expertise in threat modeling, secure systems architecture, and modern application-security design.
• Familiarity with threat frameworks like FT3 or MITRE ATT&CK and adversary kill-chain analysis.
• Knowledge of financial fraud tactics including account takeover, card testing, and credential stuffing.
• Experience with large-scale data-processing platforms like Databricks, Trino, or PySpark for monitoring control performance.
• Experience incubating software features and managing operational handoff and ownership transitions.

What you'll be doing

• Design, prototype, and deploy technical controls across API, protocol, and product boundaries to combat abuse vectors.
• Translate attacker evidence and threat research into precise technical abuse requirements and control specifications.
• Collaborate with multiple teams to design resilient, secure controls for payments, onboarding, identity, and Connect surfaces.
• Run experiments and A/B tests to measure risk reduction against impact on legitimate user conversion, optimizing controls.
• Build regression test suites and automated attack simulations to ensure mitigated abuse does not recur.
• Manage the incubation lifecycle of controls, including defining handoff criteria, operational documentation, timelines, and transfer to product teams.