{"id":133582,"url":"https://alion.io/job/stripe-security-incident-response-engineer","title":"Security Analyst","company":{"id":64,"name":"Stripe","domain":"stripe.com","url":"https://alion.io/company/stripe","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":77,"open_postings":129,"ghost_share":0.031,"stale_share":0.589,"repost_share":0.062,"time_to_fill_p50_days":63,"computed_at":"2026-10-31T05:58:55Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":198000,"max_usd":351000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":362},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"Databricks","optional":true},{"name":"DLP","optional":true},{"name":"GCP","optional":true},{"name":"Python","optional":true},{"name":"SIEM","optional":true},{"name":"Splunk","optional":true},{"name":"SQL","optional":true},{"name":"Windows","optional":true}],"status":"live","first_seen_at":"2026-08-19T20:33:11Z","employer_posted_date":"2026-10-26","last_verified_at":"2026-10-31T19:30:11Z","board_verified":true,"closed_at":null,"days_open":73,"trust":{"level":"ghost","repost_count":5,"flags":["repost"],"days_open":72},"description":"Who we are\nAbout Stripe\nStripe is a financial infrastructure platform for businesses. Millions of companies-from the world’s largest enterprises to the most ambitious startups-use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career.\nAbout the team\nThe Security Incident Response team works to analyze, investigate, and respond to threats before they impact Stripe’s business or users. From external attacks to insider threats, our goal is to respond with speed and precision, remediate, and support the incident postmortem process. The team is distributed, working across North America, Europe, and Asia, and will regularly coordinate with stakeholders in different time zones.\nWhat you’ll do\nYou will be leveraging your security incident response experience to analyze and respond to security notifications, events, and inquiries. You will be performing initial triage of potential security incidents through log and data analysis to determine whether or not activity is a substantiated or valid threat, assessing severity and potential impact, taking pre-approved remediation measures to contain a threat, and escalating findings to investigators for further review and analysis. You will use your knowledge of cyber threats and the results of your analysis to coordinate with partner teams to improve threat detection through tuning and creation of new use cases, to improve capabilities through enriching existing data and creation of new data feeds, and to improve triage accuracy, consistency and timeliness through automation. This role plays a critical part in threat detection and response, ultimately reducing the likelihood of security breaches and protecting sensitive company information.\nResponsibilities\nAnalyze and investigate activity on company devices and cloud infrastructure that could represent a security threat\nWork cross-functionally with the Security teams to develop solutions for analyzing security events at scale and protecting Stripe networks, systems, and data\nInterpret disparate data sources to report on trends and support investigative requests\nCollect requirements for enhancements to detection models and response systems\nLeverage existing systems and data to perform analyses and promote process improvements \nProvide actionable insights to help identify, prevent, detect, and respond to anomalous or potentially malicious user activity\nCollaborate effectively with teammates, lead projects, mentor others, and develop and champion quality operational standards across the team\nWho you are\nWe’re looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement.\nMinimum requirements\n5+ years experience in information technology or cyber security roles including incident response\n2+ years experience analyzing large data sets to solve problems and/or manage projects related to security event triage and/or workplace investigations\nPrior experience investigating and triaging security threats on endpoint devices including Mac, Linux, and Windows, as well as cloud infrastructure across AWS, Azure, and GCP.\nB.S. or M.S. in Cyber Security and Information Assurance, Data Analytics, Computer Science or related field, or equivalent experience\nWorking knowledge of SQL \nBasic knowledge of scripting or programming in Python, Go, or other programming languages\nProven experience with log querying and analysis (e.g. first or third party applications, system / data access, event logs), digital forensics, or incident response using one or more industry standard SIEM Platforms (Splunk, Sentinel, Chronicle, Elastic, etc.)\nProficiency using analytical methods to inform detection systems or guide strategic response\nStrong cross-functional collaboration and written/verbal communication skills \nAbility to think creatively and holistically about identifying and reducing risk in a complex environment\nHigh level of judgment, objectivity, and discretion \nPreferred qualifications\nPrior experience working with high volume data in a security incident response environment\nExperience with data processing and analysis tools (e.g. Jupyter Notebooks, Databricks)\nAn adversarial mindset, understanding the goals, behaviors, and TTPs of threat actors\nAbility to leverage threat intelligence and/or hunting concepts in an enterprise environment\nExperience in one or more of the following areas: user and entity behavior analytics (UEBA), SOAR/security automation, security information event management (SIEM), data loss prevention (DLP), Information Security, or Data Privacy\nOne or more security certifications through a recognized industry provider: GIAC, ISACA, ISC2, OffSec, CompTIA, etc.","description_format":"text","description_chars":5049,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Payment Processing & Gateways"],"lifecycle":[{"event":"open","at":"2026-08-19T20:33:11Z"},{"event":"close","at":"2026-09-08T18:13:22Z"},{"event":"reopen","at":"2026-09-10T19:34:11Z"},{"event":"close","at":"2026-09-22T14:36:39Z"},{"event":"reopen","at":"2026-10-06T14:38:44Z"},{"event":"close","at":"2026-10-06T17:34:22Z"},{"event":"reopen","at":"2026-10-08T14:44:54Z"},{"event":"close","at":"2026-10-12T21:40:09Z"},{"event":"reopen","at":"2026-10-13T15:16:06Z"},{"event":"close","at":"2026-10-16T17:31:33Z"},{"event":"reopen","at":"2026-10-19T20:02:02Z"},{"event":"close","at":"2026-10-21T23:04:53Z"},{"event":"reopen","at":"2026-10-26T18:37:06Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 319 · green card filings: 110","filings_12m":319,"filings_prev_12m":318,"green_card_filings_12m":110,"median_offered_wage_usd":168770,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":21}],"liveness":{"score":12,"band":"cold","label":"Long shot","p_open":1,"p_active":0.265,"p_room":0.44,"age_days":72,"expected_fill_days":63,"reasons":["conf:1","repost:5","stale_co","velocity","ghost","win:tail","crowd:brand"],"computed_at":"2026-10-31T05:58:55Z"},"pay":null,"html_url":"https://alion.io/job/stripe-security-incident-response-engineer","json_url":"https://alion.io/job/stripe-security-incident-response-engineer.json","meta":{"generated_at":"2026-10-31T22:55:37Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":35730,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-01T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":64},"rest":"https://alion.io/mcp/rest/get_company?id=64"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fstripe-security-incident-response-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fstripe-security-incident-response-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fstripe-security-incident-response-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/stripe-security-incident-response-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fstripe-security-incident-response-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":133582}},{"tool":"search_jobs","arguments":{"company":"stripe.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":133582},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}