The opportunity
Abuse Control Engineering (ACE) is Stripe’s rapid-response technical defense and control incubator. When urgent abuse vectors emerge, ACE bridges the gap using real attacker telemetry to prototype, test, and deploy software safeguards before vulnerabilities can be exploited at scale.
What you'll do
Rapid Control Prototyping: Design, prototype, and deploy technical controls across API, protocol, and product boundaries to immediately close high-impact abuse vectors. Evidence-Based Technical Requirements: Translate empirical attacker evidence and FT3 threat research Abuse Research, Fraud and Security into precise technical abuse requirements and control specifications.
Control Co-Design: Collaborate closely with teams across Stripe to co-design resilient, secure controls across payment, onboarding, identity, and Connect surfaces.
Risk Experimentation: Run rigorous experiments and A/B tests to measure risk reduction against legitimate user conversion impact, optimizing controls to minimize friction while neutralizing threats.
Regression Testing: Build comprehensive regression testing suites and automated attack simulations with Abuse Research to ensure mitigated abuse vectors do not recur.
Stakeholder Management: Execute ACE’s incubation model by defining handoff criteria, operational documentation, and target dates to transfer successful controls to product teams.
What they're looking for
- + years of experience in Security Engineering, Software Engineering,: Application Security, or Anti-Abuse Engineering in a high-scale production environment.
- B.S. or M.S. in Computer Science, Cybersecurity, Software Engineering, or a: related technical field, or equivalent practical experience.
- Strong software development background with expert proficiency in Python, Go,: Java, or similar production languages, alongside expert SQL skills for analyzing system telemetry.
- Hands-on engineering experience building API-level safeguards, rate-limiting: frameworks, authentication/authorization checks, or input validation controls.
- Demonstrated experience with automated testing frameworks, including writing: unit, integration, and regression tests for critical backend software.
- Strong cross-functional collaboration and communication skills, with a track: record of partnering across security, product, and platform teams to drive technical outcomes.
- Proven track record of designing and executing A/B tests, evaluating control: efficacy, and balancing security safeguards against user conversion friction.
- Deep expertise in threat modeling, secure system architecture, and modern: application security design principles.
