Stripe is a financial infrastructure platform for businesses, enabling companies to accept payments, grow revenue, and accelerate new business opportunities.
About the team
The Security Incident Response team triages and assesses the severity of incoming security alerts, responds with initial containment, and escalates as needed.
Analyzes data sources to identify potential threats, collects requirements for operational enhancements to detection and response systems.
Distributed globally, coordinating with stakeholders in North America, Europe, and Asia.
Responsibilities
Lead and coordinate security incident response activities and workstreams as the incident response manager (IRM).
Analyze and investigate a broad range of threats or activities on client devices, maintaining confidentiality and documenting incident details.
Make decisions and recommendations based on incident analysis and communicate context to stakeholders.
Develop, document, and implement strategies, runbooks, capabilities, and techniques for incident response.
Work cross-functionally with security engineering and data science teams to build solutions for analyzing security events data at scale.
Strengthen KPIs and metrics for measuring response effectiveness and provide reporting.
Continuously improve security processes and response capabilities.
Mentor and develop other teammates.
Requirements
5+ years experience leading Security Incident Response.
B.S. or M.S. in Computer Science or related field, or equivalent experience.
Working knowledge of Python and SQL, familiarity with other programming languages.
Experience with log analysis, network security, digital forensics, and incident response investigations.
Hands-on experience analyzing and responding to security events, developing queries and analytics, correlating complex data sets.
Proficiency with developing and using novel analytical methods to automate response processes.
Excellent written and verbal communication skills.
Ability to identify trends, insights, and relationships between data and intelligence sources.
Preferred: broad knowledge across information security (endpoint, email, network, identity management, cloud security, vulnerability management, threat intelligence); experience with Databricks, Trino; familiarity with Chronicle, osquery, LogScale, Splunk.