Offensive Security Engineer, Stripe

• 5+ years of experience in offensive security, penetration testing, or a related field
• Proven knowledge of web application security vulnerabilities, including OWASP Top 10 and ASVS
• Experience with cloud platforms such as AWS, Azure, or Google Cloud
• Proficiency in programming languages such as Python, Ruby, and GoLang, along with script development for automation
• Familiarity with web security testing tools like Burp Suite, OWASP ZAP, and similar solutions
• Excellent written and verbal communication skills, with the ability to produce concise reports that clearly communicate complex technical information to non-technical stakeholders
• Ability to think creatively and approach problem-solving with a holistic view of risk in complex environments

Desirable

• As an Offensive Security Engineer, your primary responsibility will be to simulate the behaviors and techniques of real-world adversaries to identify and mitigate security risks in Stripe's offerings.
• You will lead engagements, apply advanced testing methodologies, and provide actionable insights to product teams to ensure a robust security posture prior to product launches
• Conduct comprehensive offensive security assessments across various environments, including web applications, APIs, and other technical products, while providing technical expertise in network protocols, operating systems, and web application security
• Develop and utilize custom testing methodologies, scripts, and tools to enhance offensive security workflows
• Identify nuanced vulnerabilities and develop mitigation strategies to safeguard Stripe’s services and operations
• Collaborate effectively with fellow security team members and cross-functional teams to identify and mitigate security risks and vulnerabilities, driving improvements in the security of our products
• Lead offensive security projects and mentor junior team members, fostering a culture of continuous learning and development within the team
• Produce clear and concise reports on assessment findings, including testing plans, engagement models, risks, and actionable remediation recommendations
• Stay up-to-date with the latest security threats, vulnerabilities, and attack methods, acting as the subject-matter expert and primary contact for stakeholder teams invested in offensive security programs and Stripe-wide security initiatives
• Champion quality standards within the team, ensuring best practices are implemented and maintained