Requirements

• 10+ years of experience in security engineering, software engineering, application security, or anti-abuse engineering in a high-scale production environment.
• Bachelor’s or master’s degree in computer science, cybersecurity, software engineering, or related technical field, or equivalent practical experience.
• Strong software development background with proficiency in Python, Go, Java, or similar programming languages.
• Advanced SQL skills for analyzing system telemetry.
• Experience using frontier AI models for software development, learning, and analysis.
• Hands-on experience building API-level safeguards, rate-limiting frameworks, authentication or authorization checks, or input-validation controls.
• Experience with automated testing frameworks including unit, integration, and regression tests for backend software.
• Strong cross-functional collaboration and communication skills working across security, product, and platform teams.

Nice to Haves

• Experience designing and executing A/B tests to evaluate control efficacy and balance security with user conversion.
• Expertise in threat modeling, secure system architecture, and modern application-security design principles.
• Familiarity with threat frameworks such as FT3 or MITRE ATT&CK and adversary kill-chain analysis.
• Knowledge of financial fraud vectors and attacker tactics including account takeover, card testing, and credential stuffing.
• Hands-on experience with large-scale data-processing platforms like Databricks, Trino, or PySpark.
• Experience incubating software features and transitioning ownership to engineering teams.

What You'll Be Doing

• Design, prototype, and deploy technical defenses across API, protocol, and product boundaries to address abuse vectors.
• Translate empirical attacker evidence and threat research into precise technical abuse control requirements.
• Collaborate with teams across Stripe to co-design resilient, secure controls across payments, onboarding, identity, and Connect surfaces.
• Run rigorous experiments and A/B tests to measure risk reduction versus impact on legitimate user conversion.
• Build automated regression test suites and attack simulations to prevent abuse vectors from recurring.
• Manage incubation lifecycles including defining handoff criteria, documentation, timelines, and transferring controls to product teams.