Security Engineer

An engineer on Abuse Control Engineering, a rapid-response team in Stripe's security organisation that builds technical safeguards when new abuse methods expose weaknesses in Stripe's products. Working from real attacker telemetry and the FT3 fraud taxonomy, the engineer writes control requirements and then prototypes and ships defences such as API rate limits, step-up challenges, parameter validation and pre-debit holds across payments, onboarding, identity and Connect. Controls are tested through experiments that weigh risk reduction against lost legitimate conversions, protected by automated regression and attack simulation suites, and handed to product teams once mature.

Stripe wants three or more years in security, application security or anti-abuse engineering at scale, strong Python, Go or Java and SQL, and experience building authentication, authorisation or input validation controls. Remote in the US.