Offensive Security Engineer, Penetration Testing

Summary

Join Stripe's Proactive Threat team as an Offensive Security Engineer and simulate real-world adversary behaviors to identify and mitigate security risks. You will lead security assessments across various environments, develop custom testing methodologies, and collaborate with cross-functional teams. Responsibilities include identifying vulnerabilities, developing mitigation strategies, producing concise reports, and staying updated on the latest security threats. The ideal candidate possesses 5+ years of offensive security experience, proven knowledge of web application security vulnerabilities, and proficiency in programming languages. This role requires excellent communication skills and the ability to think creatively to solve problems in complex environments. The team is distributed, with members primarily working in the United States, and collaborates globally.

Requirements

• 5+ years of experience in offensive security, penetration testing, or a related field
• Proven knowledge of web application security vulnerabilities, including OWASP Top 10 and ASVS
• Experience with cloud platforms such as AWS, Azure, or Google Cloud
• Proficiency in programming languages such as Python, Ruby, and GoLang, along with script development for automation
• Familiarity with web security testing tools like Burp Suite, OWASP ZAP, and similar solutions
• Excellent written and verbal communication skills, with the ability to produce concise reports that clearly communicate complex technical information to non-technical stakeholders
• Ability to think creatively and approach problem-solving with a holistic view of risk in complex environments

Responsibilities

• Conduct comprehensive offensive security assessments across various environments, including web applications, APIs, and other technical products, while providing technical expertise in network protocols, operating systems, and web application security
• Develop and utilize custom testing methodologies, scripts, and tools to enhance offensive security workflows
• Identify nuanced vulnerabilities and develop mitigation strategies to safeguard Stripe’s services and operations
• Collaborate effectively with fellow security team members and cross-functional teams to identify and mitigate security risks and vulnerabilities, driving improvements in the security of our products
• Lead offensive security projects and mentor junior team members, fostering a culture of continuous learning and development within the team
• Produce clear and concise reports on assessment findings, including testing plans, engagement models, risks, and actionable remediation recommendations
• Stay up-to-date with the latest security threats, vulnerabilities, and attack methods, acting as the subject-matter expert and primary contact for stakeholder teams invested in offensive security programs and Stripe-wide security initiatives
• Champion quality standards within the team, ensuring best practices are implemented and maintained

Preferred Qualifications

• Experience conducting offensive security in the fintech or financial sectors, or relevant security consulting experience
• Familiarity with exploiting vulnerabilities and conducting vulnerability research, including CVE assignments
• Certifications such as PNPT, BSCP, OSCP, CPTS, OSWE, OSCE, OSEP, OSED, CRTO, cloud certifications, and similar
• Contributions to open-source security projects or active participation in the security community (e.g., writing blogs, presenting at conferences)
• Ability to lead critical projects independently while thriving in a fast-paced, dynamic work environment