Fraud Red Team, Staff Security Engineer

Want to be part of a team that is changing how we fight fraud? We are a unique team at Intuit that is focused on finding and quantifying fraud vulnerabilities before they are abused by adversaries.

In this role, you will learn how adversaries think and work, using your engineering skills to find new and unknown fraud vulnerabilities through both manual and automated testing across Intuit's products and in doing so you will help protect Intuit and it's millions of customers from fraud and abuse.

Responsibilities

• Develop a deep, adversarial understanding of Intuit products and customer workflows.

• Identify fraud and abuse vulnerabilities across the Intuit ecosystem.

• Write scripts that simulate fraudulent behavior and other adversarial activity.

• Work with policy, data-science, and product teams to identify and close weaknesses.

• Partner with other partners to build vulnerability-discovery tooling.

• Create proofs of concept and internal tools that improve the team’s speed and effectiveness.

• Conduct adversarial simulation of products and processes to assess the effectiveness of controls and fraud detection and prevention systems

• Identify vulnerabilities to help identify and address potential weaknesses in their fraud prevention strategies

• Provide recommendations for mitigation of vulnerabilities, lead debriefings with cross-functional partners to ensure mitigation of the detected vulnerabilities

• Knowledge of device fingerprinting, browser spoofing, proxy/VPN usage and basic scripting like Shell/Python/Java

• Create and use BOT tools and run velocity and load testing

• Fraud domain knowledge - understanding of fraud and credit risk systems, KYC, SIM-Swaps, OTP attack and social engineering tactics

• Ability to read data logs and present quantitative analytics skills

• Conduct safe testing protocols with understanding of legal and ethical elements

• Assist Fraud Incident Response Teams with incident investigations and aid in technical risk assessments

• Coordinate with system development and infrastructure units to identify fraud risks and the appropriate controls for development, day-to-day operations, and emerging technologies

• Perform regular assessments based on changes in the fraud threat landscape

• Recreate real-world fraud and abuse attacks to understand attack paths, identify control gaps, and determine how defenses can be circumvented.

• Design and build automated testing tools and scripts using APIs, Python or similar languages to simulate fraud and abuse scenarios at scale.

• Develop creative test scenarios across account creation, identity, payments, entitlements, APIs, and other customer and product experiences.

• Monitor vulnerability assessments and ensure that issues are addressed for the applications that they support

• Identify significant fraud threats and vulnerabilities

• Active champion for AI and automation adoption, you seek opportunities to apply AI-powered tooling and automation

Qualifications

• Master’s degree in computer science or a related field was preferred; equivalent practical experience was accepted.

• At least 10 years of experience as a software engineer, security researcher, or across both disciplines.

• Extensive knowledge of Burp Suite.

• Strong collaboration, communication, and cross-organizational influence skills.

• A creative mindset and willingness to challenge conventional assumptions.

• Ability to start and drive work independently.

Intuit provides a competitive compensation package with a strong pay for performance rewards approach. This position may be eligible for a cash bonus, equity rewards and benefits, in accordance with our applicable plans and programs (see more about our compensation and benefits at Intuit®: Careers | Benefits). Pay offered is based on factors such as job-related knowledge, skills, experience, and work location. To drive ongoing fair pay for employees, Intuit conducts regular comparisons across categories of ethnicity and gender.