About this role
Stripe must proactively identify security weaknesses across complex financial infrastructure before real-world adversaries can exploit them. The Proactive Threat team operates as a hybrid offensive unit, conducting penetration testing and emulating sophisticated threat actors to safeguard global payment systems.
In this role, you will simulate adversary tactics and build custom automation frameworks that scale the team's testing capabilities. You will evaluate cloud environments, web applications, and internal infrastructure while collaborating closely with defensive security teams to validate detection controls. This position suits someone who combines a hacker's mindset with strong software engineering fundamentals to tackle large-scale security challenges.
What you will do
- Conduct comprehensive penetration tests across web applications, APIs, cloud environments, and internal infrastructure.
- Plan and execute red team engagements that emulate the techniques of real-world threat actors targeting financial services.
- Perform assumed-breach assessments to test detection and response capabilities in coordination with defensive teams.
- Design and develop custom offensive tools, scripts, and automation frameworks to enhance assessment efficiency.
- Produce clear, actionable reports communicating technical findings and remediation guidance to various stakeholders.
What you need
- Have at least 5 years of experience in offensive security, penetration testing, or red teaming.
- Demonstrate strong programming skills in Python, Go, or similar languages for building tools and custom exploits.
- Possess deep knowledge of web application security principles, including the OWASP Top 10 and common vulnerability classes.
- Bring hands-on experience with cloud-native attack techniques and misconfigurations across platforms like AWS, Azure, or GCP.
- Show proficiency with standard offensive tooling such as Burp Suite, Cobalt Strike, Mythic, or BloodHound.
- Maintain familiarity with adversary tradecraft frameworks like MITRE ATT&CK.
- Exhibit excellent written and verbal communication skills to translate complex findings into risk-based recommendations.
Nice to have
- Experience conducting offensive security in fintech, financial services, or other highly regulated environments
- Background in vulnerability research, exploit development, or CVE discovery
- Experience collaborating with threat intelligence, detection engineering, or incident response teams
- Familiarity with AI and LLM-assisted development tools applied to offensive security workflows
- Relevant certifications such as OSCP, OSWE, OSEP, OSED, CRTO, CPTS, PNPT, GXPN, or cloud security credentials
Benefits
- Equity participation in Stripe's growth
- 401(k) plan with matching contributions from day one
- Comprehensive medical, dental, and vision coverage
- Wellness stipends
- Annual budget for training, certifications, and conference attendance
Skills and tech stack
Questions candidates ask
What is the remote work policy for this position?
This role is remote within the United States. While you are welcome to visit Stripe offices for team meetings, on-sites, and events, the expectation is that you would regularly work from home.
What time zones does the team operate in?
The team is distributed across the United States and primarily operates in Eastern and Pacific time zones. Team members also collaborate regularly with stakeholders in Europe and Asia.
What is the salary range for this role?
The annual US base salary range for this role is $170,400 to $255,700. This range may span multiple career levels and will be refined during the interview process based on experience, qualifications, and location.