Staff Security Engineer, Abuse Control
Stripe · Dublin · 8611 Security Analytics · listed September 17, 2026
The shape of it
Seniority
Staff
Experience asked
10+ years
Where
Not stated
Requirements listed
7
Length
723 words
In the posting’s own words
Abuse Control Engineering (ACE) is Stripe’s rapid-response technical defense and control incubator. When urgent abuse vectors emerge, ACE uses real-world attacker telemetry to prototype, test, and deploy software safeguards before vulnerabilities can be exploited at scale.
What it asks for · 7
- 10+ years of experience in security engineering, software engineering, application security, or anti-abuse engineering in a high-scale production environment.
- A bachelor’s or master’s degree in computer science, cybersecurity, software engineering, or a related technical field, or equivalent practical experience.
- A strong software development background, with proficiency in Python, Go, Java, or a similar production programming language, as well as advanced SQL skills for analyzing system telemetry.
- Experience using frontier AI models for software development, learning, and analysis.
- Hands-on experience building API-level safeguards, rate-limiting frameworks, authentication or authorization checks, or input-validation controls.
- Experience with automated testing frameworks, including writing unit, integration, and regression tests for critical backend software.
- Strong cross-functional collaboration and communication skills, with a track record of partnering across security, product, and platform teams to drive technical outcomes.
Also a plus
- A track record of designing and executing A/B tests, evaluating control efficacy, and balancing security safeguards against user conversion friction.
- Expertise in threat modeling, secure systems architecture, and modern application-security design principles.
- Familiarity with established threat frameworks, such as FT3 or MITRE ATT&CK, and experience applying adversary kill-chain analysis to build resilient defenses.
- Knowledge of financial fraud vectors, threat-actor tactics, techniques, and procedures, and attacker infrastructure, including account takeover, card testing, and credential stuffing.
- Hands-on experience with large-scale data-processing platforms, such as Databricks, Trino, or PySpark, to monitor and measure control performance across distributed systems.
- Experience incubating software features, establishing clear operational handoff criteria, and transitioning ownership to partner engineering teams.
What the job covers
- Rapid control prototyping: Design, prototype, and deploy technical controls across API, protocol, and product boundaries to address high-impact abuse vectors.
- Evidence-based technical requirements: Translate empirical attacker evidence and FT3 threat research from Abuse Research, Fraud, and Security teams into precise technical abuse requirements and control specifications.
- Control co-design: Collaborate with teams across Stripe to design resilient, secure controls across payments, onboarding, identity, and Connect surfaces.
- Risk experimentation: Run rigorous experiments and A/B tests to measure risk reduction against the impact on legitimate user conversion, optimizing controls to minimize friction while neutralizing threats.
- Regression testing: Build comprehensive regression test suites and automated attack simulations with Abuse Research to ensure mitigated abuse vectors do not recur.
- Stakeholder management: Execute ACE’s incubation model by defining handoff criteria, operational documentation, timelines, and target dates for transferring successful controls to product teams.
Degree language
- A bachelor’s or master’s degree in computer science, cybersecurity, software engineering, or a related technical field, or equivalent practical experience.
Tools and skills named
Security & compliance
- Security7×
- Threat modeling
Ways of working
- Testing3×
- Cross-functional
- Technical writing
Languages
- Go
- Java
- Python
- SQL
Data
- Databricks
- Experimentation
- Spark
Cloud & infra
- Distributed systems
Operations & finance
- Stakeholder management
Product & design
- Prototyping
Words the posting leans on
- control16×
- abuse10×
- technical9×
- engineering8×
- experience8×
- product8×
- threat8×
- requirements7×
- software7×
- ace6×
- security6×
- build5×
- regression5×
- risk5×
- safeguards5×
- tests5×
Counted from the posting after the mission statement and the legal notices are set aside. The ones near the top are the ones a screener is looking for.
The posting, your resume, and the gaps between them. One click loads all three.