Location
London

Hours
Full Time

Salary
Negotiable

About the Role
Stripe is a financial infrastructure platform used by millions of companies worldwide to accept payments, grow revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, offering you an unprecedented opportunity to impact the global economy while doing meaningful work.

The Abuse Control Engineering (ACE) team is Stripe’s rapid-response technical defense and control incubator. ACE uses real-world attacker telemetry to prototype, test, and deploy safeguards against emerging abuse vectors before they can be exploited at scale. Partnering closely with Fraud, Risk, Abuse Research, and Product Engineering teams, ACE runs rigorous experiments to balance effective risk mitigation with legitimate user activity and conversion.

As a Staff Security Engineer on the ACE team, you will design, prototype, and incubate technical defenses that protect Stripe’s financial ecosystem from complex, cross-cutting abuse threats. You will translate threat intelligence into precise technical control requirements such as API rate limits, step-up challenges, parameter validation, and pre-debit holds. You will run experiments to evaluate risk reduction against impact on legitimate users, manage controls through incubation lifecycles, build automated regression suites, and collaborate with product teams to transfer mature controls.

Key responsibilities include rapid control prototyping across API and product boundaries, translating empirical attacker evidence into technical requirements, co-designing controls with cross-functional teams, running risk experiments and A/B tests, building regression test suites, and managing stakeholder handoffs to product teams.

Experience
- 10+ years in security engineering, software engineering, application security, or anti-abuse engineering in high-scale production environments.
- Strong software development skills in Python, Go, Java, or similar languages, with advanced SQL for telemetry analysis.
- Experience using frontier AI models for software development, learning, and analysis.
- Hands-on experience building API safeguards, rate-limiting frameworks, authentication/authorization checks, or input validation controls.
- Experience with automated testing frameworks including unit, integration, and regression tests.
- Proven ability to collaborate cross-functionally with security, product, and platform teams.

About you
- Analytical and evidence-driven, able to translate threat intelligence into precise technical controls.
- Skilled in balancing security safeguards with user conversion and product velocity.
- Effective communicator and collaborator, able to manage stakeholder relationships and execute incubation lifecycles.
- Motivated to innovate and rapidly prototype defenses against emerging abuse vectors.

Qualifications
- Bachelor’s or master’s degree in computer science, cybersecurity, software engineering, or related technical field, or equivalent practical experience.
- Preferred: Experience designing and executing A/B tests to evaluate control efficacy.
- Preferred: Expertise in threat modeling, secure systems architecture, and modern application security principles.
- Preferred: Familiarity with threat frameworks such as FT3 or MITRE ATT&CK and adversary kill-chain analysis.
- Preferred: Knowledge of financial fraud vectors and attacker tactics including account takeover, card testing, and credential stuffing.
- Preferred: Experience with large-scale data-processing platforms like Databricks, Trino, or PySpark.
- Preferred: Experience incubating software features and transitioning ownership to partner engineering teams.