Security Engineer - Threat Detection

Who we areStripe is a financial infrastructure platform for businesses. Millions of companies-from the world's largest enterprises to the most ambitious startups-use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone's reach while doing the most important work of your career.About the teamThe Proactive Threat team identifies, detects, and responds to threats before they impact Stripe's business or users. The Detection Engineering & Threat Hunting function sits at the intersection of offense and defense - we leverage deep knowledge of attacker tradecraft to build high?fidelity detections, hunt for sophisticated threats, and validate defensive capabilities across Stripe's critical systems.We are builders first. Our team develops detection?as?code, automates analysis workflows, and builds tooling that scales detection and response across a complex, global environment. We partner closely with Threat Intelligence, Incident Response, and offensive security teams to ensure our detections are grounded in real?world adversary behavior.The team is distributed across the United States (Eastern and Pacific time zones) and collaborates regularly with stakeholders across Stripe - including teams in Europe and Asia.What you'll doYou will design, build, and maintain detections that identify malicious activity across Stripe's infrastructure, applications, and cloud environments. You'll leverage your understanding of attacker TTPs - from initial access through exfiltration - to develop detection logic that catches real threats while minimizing noise. Beyond writing detections, you'll conduct threat hunts, perform malware analysis, and build automation that enables detection engineering at scale.ResponsibilitiesDesign, build, and tune high?fidelity detections across modern SIEM platforms, covering adversary TTPs across the full attack lifecycleDevelop detection hypotheses by researching TTPs, identifying evidence sources, and determining detection opportunities across available telemetryConduct hypothesis?driven threat hunts to identify malicious activity, uncover detection gaps, and validate security controlsPerform malware analysis and reverse engineering to extract indicators and inform detection strategiesBuild network?based detections (flow, pcap, protocol analysis) and endpoint?based detections (event logs, EDR telemetry, memory/file artifacts) across Windows, Linux, and macOSPartner with Threat Intelligence to operationalize intel reports into detections, hunting leads, and enrichment logicCollaborate with IR, SOC, and offensive security teams to validate and refine detections based on real?world incidents and red team exercisesBuild data pipelines, automation, and tooling that enable detection?as?code practices and scalable deploymentMap detection coverage to MITRE ATT&CK, identifying and prioritizing gaps across key attack surfacesLead projects, mentor teammates, and champion quality standards within the teamWho you areWe're looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement.Minimum requirements5+ years of experience in detection engineering, threat hunting, or security operationsDemonstrated experience writing detection logic in modern SIEM platforms (e.g., Splunk, Chronicle, Elastic, CrowdStrike NG?SIEM, Panther, Microsoft Sentinel)Strong understanding of adversary tradecraft across the attack lifecycle: initial access, privilege escalation, lateral movement, defense evasion, persistence, and exfiltrationAbility to extract TTPs from threat intelligence reports and translate them into detection opportunitiesExperience developing network?based and endpoint?based detections across multiple OS platforms (Windows, Linux, macOS)Experience analyzing telemetry across endpoint, network, cloud (AWS/GCP/Azure), identity, and application log sourcesProficiency in detection/query languages (SPL, KQL, EQL, YARA?L, SQL) and programming (Python or similar)Strong communication skills with the ability to document detection logic and explain findings to technical and non?technical audiencesAdversarial mindset - understanding how attackers operate to build detections that catch real?world threatsPreferred qualificationsExperience in detection engineering or threat hunting within fintech, financial services, or highly regulated environmentsBackground in malware analysis, reverse engineering, or threat researchExperience with purple team operations - collaborating with offensive security to validate detectionsFamiliarity with big data platforms (Databricks, Trino, PySpark) for large?scale log analysisProficiency with AI/LLM?assisted development tools (Claude Code, Cursor, GitHub Copilot) applied to detection workflowsInterest in agentic automation - using LLMs to augment hunting, tuning, or triageExperience with detection validation tools (Atomic Red Team, ATT&CK Evaluations)Contributions to open?source detection content, research, or conference presentationsRelevant certifications such as HTB CDSA, GCIH, GCFA, GNFA, OSCP, TCM PMAT, or GREM Linux, SIEM, Malware Analysis, Reverse Engineering, MITRE ATT&CK#J-*****-Ljbffr

5+ years of experience in detection engineering, threat hunting, or security operations Demonstrated experience writing detection logic in modern SIEM platforms (e.g., Splunk, Chronicle, Elastic, CrowdStrike NG?SIEM, Panther, Microsoft Sentinel) Strong understanding of adversary tradecraft across the attack lifecycle: initial access, privilege escalation, lateral movement, defense evasion, persistence, and exfiltration Ability to extract TTPs from threat intelligence reports and translate them into detection opportunities Experience developing network?based and endpoint?based detections across multiple OS platforms (Windows, Linux, macOS) Experience analyzing telemetry across endpoint, network, cloud (AWS/GCP/Azure), identity, and application log sources Proficiency in detection/query languages (SPL, KQL, EQL, YARA?L, SQL) and programming (Python or similar) Strong communication skills with the ability to document detection logic and explain findings to technical and non?technical audiences Adversarial mindset - understanding how attackers operate to build detections that catch real?world threats Preferred qualifications Experience in detection engineering or threat hunting within fintech, financial services, or highly regulated environments Background in malware analysis, reverse engineering, or threat research Experience with purple team operations - collaborating with offensive security to validate detections Familiarity with big data platforms (Databricks, Trino, PySpark) for large?scale log analysis Proficiency with AI/LLM?assisted development tools (Claude Code, Cursor, GitHub Copilot) applied to detection workflows Interest in agentic automation - using LLMs to augment hunting, tuning, or triage Experience with detection validation tools (Atomic Red Team, ATT&CK Evaluations) Contributions to open?source detection content, research, or conference presentations Relevant certifications such as HTB CDSA, GCIH, GCFA, GNFA, OSCP, TCM PMAT, or GREM Linux, SIEM, Malware Analysis, Reverse Engineering, MITRE ATT&CK #J-*****-Ljbffr

Stripe is a financial infrastructure platform for businesses. Millions of companies-from the world's largest enterprises to the most ambitious startups-use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone's reach while doing the most important work of your career. About the team