Staff Security Engineer, Abuse Control
Staff Security Engineer on Stripe's Abuse Control Engineering (ACE) team in Dublin, rapidly designing, prototyping, and incubating technical defenses against cross-cutting abuse vectors across payments and identity surfaces. Day-to-day work spans API safeguards, rate limits, A/B risk experiments, and regression suites using Python, Go, or Java plus SQL.
- Compensation
- Not disclosed
- Location
- Dublin
- Work setup
- Not specified
- Seniority
- Staff
- Employment
- Not specified
- Experience
- 10+ years
- Category
- Security
- Posted
Skills
Must have
- 10+ years of experience in security engineering, software engineering, application security, or anti-abuse engineering in a high-scale production environment
- Bachelor's or master's degree in computer science, cybersecurity, software engineering, or a related technical field, or equivalent practical experience
- Strong software development background with proficiency in Python, Go, Java, or a similar production programming language
- Advanced SQL skills for analyzing system telemetry
- Experience using frontier AI models for software development, learning, and analysis
- Hands-on experience building API-level safeguards, rate-limiting frameworks, authentication or authorization checks, or input-validation controls
- Experience with automated testing frameworks, including unit, integration, and regression tests for critical backend software
- Strong cross-functional collaboration and communication skills, partnering across security, product, and platform teams
Nice to have
- Track record of designing and executing A/B tests, evaluating control efficacy, and balancing security safeguards against user conversion friction
- Expertise in threat modeling, secure systems architecture, and modern application-security design principles
- Familiarity with threat frameworks such as FT3 or MITRE ATT&CK and adversary kill-chain analysis
- Knowledge of financial fraud vectors and attacker tactics, including account takeover, card testing, and credential stuffing
- Hands-on experience with large-scale data-processing platforms such as Databricks, Trino, or PySpark
- Experience incubating software features, establishing handoff criteria, and transitioning ownership to partner engineering teams
Full description
Who we are
About Stripe
Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career.
About the team
Abuse Control Engineering (ACE) is Stripe’s rapid-response technical defense and control incubator. When urgent abuse vectors emerge, ACE uses real-world attacker telemetry to prototype, test, and deploy software safeguards before vulnerabilities can be exploited at scale.
We partner closely with Fraud, Risk, Abuse Research, and Product Engineering to run rigorous experiments that balance effective risk mitigation with legitimate user activity and conversion. Operating as both a strike team and an incubator, ACE builds automated regression suites to prevent threats from recurring and transfers mature controls to long-term product owners across Stripe.
What you’ll do
As an Abuse Control Engineer on the ACE team, you will design, prototype, and incubate technical defenses that safeguard Stripe’s financial ecosystem against complex, cross-cutting abuse vectors.
When emerging threat patterns reveal weaknesses in Stripe products, ACE rapidly builds and experiments with technical safeguards. Guided by empirical evidence and Stripe’s Fraud Taxonomy 3.0 (FT3) framework, you will translate threat intelligence into precise technical control requirements, such as API rate limits, step-up challenges, parameter validation, and pre-debit holds.
You will run experiments to evaluate risk reduction against the impact on legitimate user conversion, carefully balancing security and product velocity. You will manage controls through a structured incubation lifecycle, build automated regression suites to prevent threats from recurring, and partner with product engineering teams to transfer mature, long-term defenses.
Responsibilities
- Rapid control prototyping: Design, prototype, and deploy technical controls across API, protocol, and product boundaries to address high-impact abuse vectors.
- Evidence-based technical requirements: Translate empirical attacker evidence and FT3 threat research from Abuse Research, Fraud, and Security teams into precise technical abuse requirements and control specifications.
- Control co-design: Collaborate with teams across Stripe to design resilient, secure controls across payments, onboarding, identity, and Connect surfaces.