安全事件响应经理, 滥用运营
Security Incident Response Manager, Abuse Operations
我们是谁
关于 Stripe
Stripe 是一家为 businesses 提供金融基础设施的平台。数以百万计的公司——从全球最大的企业到最具雄心的初创公司——都使用 Stripe 来接受支付、增长收入并加速新的商业机会。我们的使命是提升互联网的 GDP，而我们还有大量工作要做。这意味着你将有机会在职业生涯中做最重要的工作，同时让全球经济触手可及。
关于团队
Abuse Operations 是处理直接影响 Stripe 及其商户的产品滥用和欺诈行为的一线事件响应和补救功能。这个跨学科团队包括事件经理、调查员、前线部署安全工程师和数据科学家，他们中和主动攻击，收集操作工具的需求，并领导事件。该团队直接与受影响的商户合作，快速解决事件和政策滥用。该团队主要分布在东、太平洋和西欧时区，这些成员经常与全球利益相关者协调。
你会做什么
在这个职位中，你将发挥关键作用，通过调查高风险账户、识别复杂的欺诈模式、执行事件后分析，并推动跨职能改进来扩大欺诈检测能力，从而保护我们的金融生态系统。在这些核心运营职责的基础上，你将利用你在欺诈、滥用或产品信任方面的经验，通过管理整个欺诈和滥用事件响应流程、制定响应计划、领导工作流以及作为事件指挥官确保及时解决，来提升 Stripe 的事件响应能力。此外，你还将进行模拟演练，对响应流程进行压力测试，推动主动改进，并使用代理方法自动化响应工作流，确保我们以速度和精度中和威胁，同时持续提升 Stripe 的欺诈和滥用事件响应功能。
职责
- 作为事件响应经理（IRM），全程领导欺诈和滥用事件响应，协调工作流，调查高风险活动和账户，并在压力下提出可操作的缓解建议。
- 调查、缓解和修复紧急欺诈事件（例如 ATO、卡测试），利用 FT3 映射（欺诈分类 3.0）检测和签名
查看英文原文
Who we are
About Stripe
Stripe is a financial infrastructure platform for businesses. Millions of companies - from the world’s largest enterprises to the most ambitious startups - use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone's reach while doing the most important work of your career.
About the team
Abuse Operations is the front-line incident response and remediation function handling active product abuse and fraud impacting Stripe and its merchants. This multi-disciplinary group, spanning Incident Managers, Investigators, Forward Deployed Security Engineers, and Data Scientists, neutralizes active attacks, gathers requirements for operational tooling, and leads incidents. The team works directly with impacted merchants to resolve incidents and policy abuse rapidly. Operating primarily across Eastern, Pacific and Western European time zones, these team members regularly coordinate with global stakeholders across the world.
What you’ll do
In this role, you will play a critical part in safeguarding our financial ecosystem by investigating high-risk accounts, identifying complex fraud patterns, performing post-incident analyses, and driving cross-functional improvements to scale fraud detection. Building on these core operational duties, you will leverage your fraud, abuse, or product trust experience to improve incident response capabilities across Stripe by managing the entire fraud and abuse incident response process, developing response plans, leading workstreams, and serving as incident commander to ensure timely resolution. Furthermore, you will conduct gamedays to pressure-test response processes, drive proactive improvements, and help automate response workflows using agentic approaches ensuring we neutralize threats with speed and precision while continuously elevating Stripe's fraud and abuse incident response function.
Responsibilities
- Lead fraud and abuse incident response end-to-end as Incident Response Manager (IRM), coordinating workstreams, investigating high risk activity and accounts, and making actionable mitigation recommendations under pressure.
- Investigate, mitigate, and remediate urgent fraud incidents (e.g., ATO, card testing), utilizing FT3-mapped (Fraud Taxonomy 3.0) detection and signals enrichment to reduce uncertainty and accelerate response.
- As part of incidents, analyze high-risk accounts to identify fraudulent merchants, card testing, account takeovers, and other fraud vectors, classifying them using FT3 to standardize threat intelligence.
- Develop, document, and execute incident response strategies, runbooks, and capabilities to continuously improve fraud and abuse detection and prevention.
- Partner cross-functionally with security, data science, legal, and policy teams to build agentic response solutions, refine KPIs, and deliver clear incident reporting.
- Mentor teammates, lead key incident response engineering projects, and elevate quality standards across the team.
Who you are
We're looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement.
Minimum requirements
- 10+ years of experience leading security or fraud incident response;
- B.S./M.S. in Computer Science or equivalent experience.
- Expert knowledge of Python and SQL, and familiarity with other programming languages
- Existing experience with log analysis (e.g. first or third party applications, system / data access, event logs), network security, digital forensics, and incident response investigations
- Proven ability to build automated response workflows, leverage threat intelligence, and make risk mitigation recommendations.
- Strong written and verbal communication skills with a track record of driving cross-functional alignment with minimal oversight.
Preferred qualifications
- Broad expertise across fraud and abuse mitigation, risk management, product trust, and threat intelligence in a complex platform environment.
- An adversarial mindset, understanding the goals, behaviors, and TTPs of threat actors.
- Experience with engineering, data processing and analysis tools (e.g. Databricks, Trino, etc.)
- Familiarity with common open-source frameworks for big data processing and/or data science (PySpark, Pandas, Sci-kit Learn, etc.)
- Experience with tactical threat intelligence and/or hunting for sophisticated threat actors in an enterprise environment
- Ability to proactively challenge the status quo by leveraging data and taking a user-centric approach to address complex product integrity challenges.