Forward Deployed Security Engineer

About the role

Stripe's Abuse Operations team handles active product abuse and fraud affecting Stripe and its merchants. It is a multi-disciplinary group of Incident Managers, Investigators, Forward Deployed Security Engineers and Data Scientists that neutralises active attacks, gathers requirements for operational tooling and leads incidents, working across Eastern, Pacific and Western European time zones. As a Forward Deployed Security Engineer you will respond to live fraud and abuse incidents and act as a bridge between incidents and merchants to help them remediate threats and protect their accounts.

Key responsibilities

• Respond to live fraud and abuse incidents, investigating high-risk activity and neutralising active attacks
• Investigate and remediate urgent fraud incidents such as account takeovers and card testing, using FT3-mapped detection and signal enrichment
• Analyse high-risk accounts to identify fraudulent merchants, card testing and account takeovers, classifying them with FT3
• Develop, document and execute incident response strategies, runbooks and capabilities
• Work directly with impacted merchants and customers to help them investigate root causes and secure their accounts
• Act as liaison for legal teams, policy partners and threat intelligence communities, and build relationships with external threat intelligence groups and law enforcement

Required profile

• 10+ years of experience leading security or fraud incident response
• B.S./M.S. in Computer Science or equivalent experience
• Experience with log analysis, network security, digital forensics and incident response investigations
• Proven ability to build automated response workflows, use threat intelligence and make risk mitigation recommendations
• Strong written and verbal communication, with a track record of driving cross-functional alignment with minimal oversight
• Previous work with law enforcement and engagement in threat intelligence sharing communities

Required skills

• Expert knowledge of Python and SQL, familiarity with other programming languages
• Preferred: broad expertise in fraud and abuse mitigation, risk management, product trust and threat intelligence
• Preferred: adversarial mindset, experience with tools such as Databricks, Trino, PySpark, Pandas and Sci-kit Learn, and tactical threat intelligence or threat hunting