Stripe is a financial infrastructure platform for businesses, enabling companies to accept payments, grow revenue, and accelerate new business opportunities.
About the team
Abuse Operations is the front-line incident response and remediation function handling active product abuse and fraud impacting Stripe and its merchants.
The multi-disciplinary group spans Incident Managers, Investigators, Forward Deployed Security Engineers, and Data Scientists.
The team works directly with impacted merchants to resolve incidents and policy abuse rapidly.
Responsibilities
Lead fraud and abuse incident response end-to-end as Incident Response Manager (IRM), coordinating workstreams and making actionable mitigation recommendations under pressure
Investigate, mitigate, and remediate urgent fraud incidents (e.g., ATO, card testing) using FT3-mapped detection and signals enrichment
Analyze high-risk accounts to identify fraudulent merchants, card testing, account takeovers, and other fraud vectors
Develop, document, and execute incident response strategies, runbooks, and capabilities
Partner cross-functionally with security, data science, legal, and policy teams to build agentic response solutions and refine KPIs
Mentor teammates, lead key incident response engineering projects, and elevate quality standards
Requirements
10+ years of experience leading security or fraud incident response
B.S./M.S. in Computer Science or equivalent experience
Expert knowledge of Python and SQL, and familiarity with other programming languages
Experience with log analysis, network security, digital forensics, and incident response investigations
Proven ability to build automated response workflows, leverage threat intelligence, and make risk mitigation recommendations
Strong written and verbal communication skills with a track record of driving cross-functional alignment
Preferred qualifications
Broad expertise across fraud and abuse mitigation, risk management, product trust, and threat intelligence
An adversarial mindset, understanding the goals, behaviors, and TTPs of threat actors
Experience with engineering, data processing and analysis tools (e.g., Databricks, Trino)
Familiarity with common open-source frameworks for big data processing and/or data science (PySpark, Pandas, Sci-kit Learn)
Experience with tactical threat intelligence and/or hunting for sophisticated threat actors
Ability to proactively challenge the status quo using data and a user-centric approach