Abuse Investigator
Stripe · Seattle, San Francisco, New York City
About this role
**Abuse Investigator** at Stripe **About the Role** Join Stripe's Abuse Operations team as a critical safeguard for our financial ecosystem. You'll investigate high-risk accounts, identify complex fraud patterns, and lead incident response for product abuse and fraud events. Your work will drive improvements in fraud detection and prevention strategies at scale. **Key Responsibilities** • Investigate, mitigate, and remediate urgent fraud incidents (ATO, card testing, etc.) • Analyze high-risk accounts to identify fraudulent merchants and fraud vectors using FT3 framework • Lead incident root cause analyses and drive process improvements • Streamline incident response capabilities and tooling • Collaborate cross-functionally with security, fraud, data science, legal, and policy teams • Build agentic solutions for responding to abuse incidents at scale • Mentor teammates and champion quality standards **Minimum Requirements** • 10+ years incident response experience in security, product abuse, or trust domains • 10+ years analyzing large datasets and/or building behavioral fraud detection models • B.S./M.S. in Computer Science or equivalent experience • Expert Python and SQL; familiarity with other programming languages • Experience with log analysis, network security, digital forensics, and incident response • Strong communication and impact-focused problem-solving skills • Creative, holistic approach to risk reduction in complex environments **Preferred Qualifications** • Adversarial mindset and understanding of threat actor behaviors • Experience with Databricks, Trino, or similar data tools • Familiarity with PySpark, Pandas, Scikit-Learn, or similar frameworks • Tactical threat intelligence and sophisticated threat actor hunting experience • Data-driven, user-centric approach to product integrity challenges
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.