Investigator

Summary

Stripe is a financial infrastructure platform for businesses. The Investigator will safeguard Stripe’s financial ecosystem by investigating high-risk accounts, identifying complex fraud patterns, leading incident response and root-cause analyses, and improving fraud detection, prevention, and automated response processes.

Responsibilities

• Investigate, mitigate, and remediate urgent fraud incidents (e.g., ATO, card testing), utilizing FT3-mapped detection and signals enrichment to reduce uncertainty and accelerate response
• As part of incidents, analyze high-risk accounts to identify fraudulent merchants, card testing, account takeovers, and other fraud vectors, classifying them using FT3 (Fraud Taxonomy 3.0) to standardize threat intelligence
• Lead incident root cause analyses to identify gaps in current systems and strategies, leveraging the FT3 framework, data-driven model to drive enhancements and process improvements for emerging fraud risks
• Streamline incident response capabilities, ensuring the tooling and processes are clear, accurate and efficient
• Work cross-functionally with security, fraud and data science teams to build agentic solutions for responding to abuse incidents at scale
• Effectively communicate cross-functionally with legal and policy teams to assess and mitigate risks, while demonstrating strong problem-solving under pressure
• Collaborate effectively with teammates, leading projects, mentoring others, and developing and championing quality standards within the team

Skills

• 3+ years of experience conducting incident response in security, product abuse or trust domains
• 3+ years experience analyzing large data sets to solve problems and/or building models with a behavioral approach to fraud detection
• B.S. or M.S. Computer Science or related field, or equivalent experience
• Expert knowledge of Python and SQL, and familiarity with other programming languages
• Existing experience with log analysis (e.g. first or third party applications, system / data access, event logs), network security, digital forensics, and incident response investigations
• Ability to communicate results clearly and focus on impact
• Ability to think creatively and holistically about reducing risk in a complex environment
• An adversarial mindset, understanding the goals, behaviors, and TTPs of threat actors
• Experience with engineering, data processing and analysis tools (e.g. Databricks, Trino, etc.)
• Familiarity with common open-source frameworks for big data processing and/or data science (PySpark, Pandas, Sci-kit Learn, etc.)
• Experience with tactical threat intelligence and/or hunting for sophisticated threat actors in an enterprise environment
• Ability to proactively challenge the status quo by leveraging data and taking a user-centric approach to address complex product integrity challenges

Qualifications

Must Haves

• 3+ years of experience conducting incident response in security, product abuse or trust domains
• 3+ years experience analyzing large data sets to solve problems and/or building models with a behavioral approach to fraud detection
• B.S. or M.S. Computer Science or related field, or equivalent experience
• Expert knowledge of Python and SQL, and familiarity with other programming languages
• Existing experience with log analysis (e.g. first or third party applications, system / data access, event logs), network security, digital forensics, and incident response investigations
• Ability to communicate results clearly and focus on impact
• Ability to think creatively and holistically about reducing risk in a complex environment

Nice to Haves

• An adversarial mindset, understanding the goals, behaviors, and TTPs of threat actors
• Experience with engineering, data processing and analysis tools (e.g. Databricks, Trino, etc.)
• Familiarity with common open-source frameworks for big data processing and/or data science (PySpark, Pandas, Sci-kit Learn, etc.)
• Experience with tactical threat intelligence and/or hunting for sophisticated threat actors in an enterprise environment
• Ability to proactively challenge the status quo by leveraging data and taking a user-centric approach to address complex product integrity challenges