Abuse Research Engineer

The role

This role sits in Stripe's Abuse Research Group, which hunts for adversary behavior before alerts fire. The engineer works across internal telemetry and outside sources, using Stripe's FT3 fraud taxonomy to structure findings and feed simulations.

What you would do

• Form testable hypotheses and run repeated hunts across internal systems and external data
• Apply the FT3 framework to datasets and incidents, aligning kill-chain phases and targeted endpoints
• Work with intelligence partners to fold threat feeds into engineering pipelines
• Convert investigations into advisories and control suggestions spanning policy, systems, support, and detection
• Use automated agentic testing to replay adversary techniques and confirm controls break attack chains
• Build regression scenarios that keep controls exercised over time

What they asked for

• 5+ years in threat intelligence, threat hunting, or incident response within security, abuse, or trust work
• 5+ years analyzing large complex datasets to surface anomalies and fraud patterns
• Bachelor's or master's in a technical field, or equivalent hands-on experience
• Advanced Python and SQL skills used for automation, tooling, and big-data querying
• Practical experience with log analysis, digital forensics, and investigation methods
• Ability to explain technical research clearly to non-technical cross-functional partners

Nice to have

• Working knowledge of financial fraud tactics such as account takeover, card testing, and credential stuffing
• Familiarity with FT3 or MITRE ATT&CK
• Experience with Databricks, Trino, PySpark, Pandas, or Scikit-Learn
• Background with threat intelligence platforms, tactical feeds, OSINT, or breach intelligence
• Experience building or using agentic LLM tools or control validation frameworks
• Conference participation, threat-sharing groups, or certifications like GCTI, GCFA, or OSCP