About this role
Analytical security practitioners who enjoy mapping complex fraud patterns and building proactive defense mechanisms will thrive in this role. The Abuse Research Group at Stripe focuses on anticipating malicious actor behavior rather than merely reacting to security alerts, utilizing advanced telemetry and agentic testing frameworks to protect the financial infrastructure.
As an Abuse Research Engineer, the chosen candidate will lead hypothesis-driven threat hunting initiatives, dissect intricate fraud vectors, and leverage Stripe's Fraud Taxonomy 3.0 framework. Daily responsibilities include collaborating with cross-functional partners across risk, security, and fraud operations to translate empirical research into systematic control recommendations and automated simulation workflows.
What you will do
- Formulate hypotheses and conduct iterative threat hunting operations across internal systems and external data sources.
- Apply and enrich the FT3 framework across empirical datasets and incidents to standardize threat intelligence.
- Partner with teams like Fraud Intelligence to integrate, curate, and automate threat feeds into engineering workflows.
- Translate raw research and retrospective findings into actionable threat advisories and control recommendations for stakeholders.
- Utilize agentic automated testing frameworks to simulate adversary tactics, techniques, and procedures.
- Validate whether deployed controls interrupt empirical kill chains and generate regression scenarios to exercise controls.
What you need
- Bring 5+ years of experience conducting threat intelligence, threat hunting, or technical incident response within cyber security, product abuse, or trust domains.
- Demonstrate 5+ years of experience analyzing large, complex datasets using data analytics tools to identify anomalies and solve fraud problems.
- Hold a B.S. or M.S. in Computer Science, Cybersecurity, or a related technical field, or possess equivalent practical experience.
- Demonstrate expert proficiency in Python and SQL with experience automating workflows and querying big data pipelines.
- Possess hands-on experience in log analysis, digital forensics, and cyber investigation methodologies.
- Exhibit strong communication skills with the ability to translate complex technical research into clear recommendations.
Nice to have
- Deep technical understanding of threat actor motivations, infrastructure, and TTPs specific to financial fraud
- Familiarity with standardized taxonomies such as FT3 or MITRE ATT&CK
- Proficiency with engineering, data processing, and analysis platforms such as Databricks, Trino, PySpark, Pandas, or Scikit-Learn
- Proven background utilizing Threat Intelligence Platforms, tactical threat feeds, OSINT, and breach intelligence
- Demonstrated capability building or leveraging agentic LLM tools, automated testing systems, or control validation frameworks
Skills and tech stack
Questions candidates ask
What is the remote work policy for this position?
The position is remote from the US.
What does the team actually work on?
The Abuse Research Group handles proactive threat hunting and adversary behavior analysis across Stripe products. The team maps end-to-end fraud and abuse paths, validates novel attack vectors, and identifies product conditions that enable fraud.
What core framework is utilized in this role?
Central to this work is FT3 (Fraud Taxonomy 3.0), Stripe’s multi-layered taxonomy that decomposes monolithic fraud into structured kill chains. Practitioners apply and enrich this framework across empirical datasets and incidents.