security
Posted 4 days agoSecurity Engineer - Offensive Security
at Stripe
IrelandHybrid
Responsibilities
- Conduct comprehensive penetration tests across web applications, APIs, cloud environments (AWS/GCP/Azure), mobile applications, and internal infrastructure
- Plan and execute red team engagements that emulate the TTPs of cyber and criminal threat actors targeting financial services, including initial access, lateral movement, persistence, and data exfiltration scenarios
- Perform assumed-breach and objective-based assessments to test detection and response capabilities in coordination with defensive teams
- Support incident investigations by providing offensive expertise, log analysis, and root cause analysis when required
- Design, develop, and maintain custom offensive tools, scripts, and automation frameworks to enhance assessment efficiency and coverage
- Build internal platforms and workflows that enable scalable, repeatable offensive operations
- Automate repetitive testing tasks, payload generation, and reporting workflows using modern development practices
- Produce clear, actionable reports that communicate technical findings, business risk, and remediation guidance to both technical and non-technical stakeholders
- Lead offensive security projects end-to-end, mentor junior team members, and foster a culture of continuous learning and knowledge sharing
Requirements
- experience in offensive security, penetration testing, red teaming, or a related field
- Strong programming skills in Python, Go, or similar languages, with demonstrated
- Deep knowledge of web application security, including OWASP Top 10, ASVS, and common vulnerability classes (injection, auth flaws, business logic, etc.) Hands-on
- experience with cloud platforms (AWS, Azure, or GCP), including cloud-native attack techniques and misconfigurations
- Proficiency with offensive tooling such as Burp Suite, Cobalt Strike, Mythic, Sliver, BloodHound, or similar frameworks
- Familiarity with adversary tradecraft and frameworks such as MITRE ATT&CK, including TTPs for initial access, privilege escalation, lateral movement, and exfiltration
- Excellent written and verbal communication skills, with the ability to translate complex technical findings into clear, risk-based recommendations
- Ability to think like an adversary — creative, persistent, and able to holistically assess risk in complex environments Preferred [REQUIREMENTS] qualifications •
- Experience conducting offensive security in fintech, financial services, or other highly regulated environments
- Experience collaborating with threat intelligence, detection engineering, or incident response teams (purple team operations)
- Familiarity with big data and log analysis tools (Splunk, Databricks, PySpark, osquery, etc.) for threat hunting or investigative support
- Proficiency with AI/LLM-assisted development tools (e.g., Claude Code, Cursor, GitHub Copilot) and
- experience applying them to offensive security workflows Interest or
- experience in agentic automation — using LLMs or autonomous agents to augment reconnaissance, vulnerability discovery, or exploitation workflows •
- Experience testing AI/ML systems or LLM-based applications for security weaknesses (prompt injection, training data extraction, model manipulation, etc.)
- Relevant certifications such as OSCP, OSWE, OSEP, OSED, CRTO, CPTS, PNPT, GXPN, or cloud security certifications
Experience
- Minimum requirements 5+ years of
Benefits
- qualifications are a bonus, not a requirement.
Additional details
- Stripe is a financial infrastructure platform for businesses.
- Millions of companies—from the world's largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities.
- Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead.
- That means you have an unprecedented opportunity to put the global economy within everyone's reach while doing the most important work of your career. About the team
- The Proactive Threat team is responsible for identifying vulnerabilities and security weaknesses across Stripe's systems, applications, networks, and cloud infrastructure — before adversaries do.
- We operate as a hybrid offensive function: conducting penetration testing, emulating real-world threat actors through red team operations, and partnering closely with our defensive security teams to validate detection capabilities and improve Stripe's overall security posture.
- Our team develops custom tooling, automation frameworks, and internal platforms that scale our offensive capabilities and enable repeatable, high-fidelity assessments.
- We believe the best offensive security engineers are equal parts hacker and engineer.
- The team is distributed across the United States, primarily operating in Eastern and Pacific time zones, and collaborates regularly with security, engineering, and product stakeholders across Stripe — including teams in Europe and Asia. What you'll do
- As an Offensive Security Engineer on the Proactive Threat team, you will simulate the tactics, techniques, and procedures (TTPs) of real-world adversaries to uncover security risks across Stripe's products and infrastructure.