Incident Response Manager - Abuse Operations
Stripe · Dublin · 8611 Security Analytics · listed September 3, 2026
The shape of it
Seniority
Manager
Experience asked
10+ years
Where
Not stated
Requirements listed
6
Length
649 words
In the posting’s own words
Abuse Operations is the front-line incident response and remediation function handling active product abuse and fraud impacting Stripe and its merchants. This multi-disciplinary group, spanning Incident Managers, Investigators, Forward Deployed Security Engineers, and Data Scientists, neutralizes active attacks, gathers requirements for operational tooling, and leads incidents. The team works directly with impacted merchants to resolve incidents and policy abuse rapidly. Operating primarily across Eastern, Pacific and Western European time zones, these team members regularly coordinate with global stakeholders across the world.
What it asks for · 6
- 10+ years of experience leading security or fraud incident response;
- B.S./M.S. in Computer Science or equivalent experience.
- Expert knowledge of Python and SQL, and familiarity with other programming languages
- Existing experience with log analysis (e.g. first or third party applications, system / data access, event logs), network security, digital forensics, and incident response investigations
- Proven ability to build automated response workflows, leverage threat intelligence, and make risk mitigation recommendations.
- Strong written and verbal communication skills with a track record of driving cross-functional alignment with minimal oversight.
Also a plus
- Broad expertise across fraud and abuse mitigation, risk management, product trust, and threat intelligence in a complex platform environment.
- An adversarial mindset, understanding the goals, behaviors, and TTPs of threat actors.
- Experience with engineering, data processing and analysis tools (e.g. Databricks, Trino, etc.)
- Familiarity with common open-source frameworks for big data processing and/or data science (PySpark, Pandas, Sci-kit Learn, etc.)
- Experience with tactical threat intelligence and/or hunting for sophisticated threat actors in an enterprise environment
- Ability to proactively challenge the status quo by leveraging data and taking a user-centric approach to address complex product integrity challenges.
What the job covers
- Lead fraud and abuse incident response end-to-end as Incident Response Manager (IRM), coordinating workstreams, investigating high risk activity and accounts, and making actionable mitigation recommendations under pressure.
- Investigate, mitigate, and remediate urgent fraud incidents (e.g., ATO, card testing), utilizing FT3-mapped (Fraud Taxonomy 3.0) detection and signals enrichment to reduce uncertainty and accelerate response.
- As part of incidents, analyze high-risk accounts to identify fraudulent merchants, card testing, account takeovers, and other fraud vectors, classifying them using FT3 to standardize threat intelligence.
- Develop, document, and execute incident response strategies, runbooks, and capabilities to continuously improve fraud and abuse detection and prevention.
- Partner cross-functionally with security, data science, legal, and policy teams to build agentic response solutions, refine KPIs, and deliver clear incident reporting.
- Mentor teammates, lead key incident response engineering projects, and elevate quality standards across the team.
Degree language
- B.S./M.S. in Computer Science or equivalent experience.
Tools and skills named
Security & compliance
- Security4×
- Risk management
Ways of working
- Cross-functional2×
- Testing2×
Data
- Databricks
- Pandas
- Spark
Languages
- Python
- SQL
Words the posting leans on
- incident17×
- fraud13×
- incident response10×
- abuse9×
- data7×
- threat7×
- experience6×
- requirements5×
- accounts4×
- product4×
- security4×
- threat intelligence4×
- abuse incident3×
- complex3×
- detection3×
- e.g3×
Counted from the posting after the mission statement and the legal notices are set aside. The ones near the top are the ones a screener is looking for.
The posting, your resume, and the gaps between them. One click loads all three.