Security Analyst

About the Team

The Security Incident Response team works to analyze, investigate, and respond to threats before they impact Stripe’s business or users. From external attacks to insider threats, our goal is to respond with speed and precision, remediate, and support the incident postmortem process. The team is distributed, working across North America, Europe, and Asia, and regularly coordinates with stakeholders in different time zones.

What You’ll Do

You will leverage security incident response experience to analyze and respond to security notifications, events, and inquiries. You will perform initial triage of potential security incidents through log and data analysis, assess severity and impact, execute pre-approved remediation measures, and escalate findings to investigators. Additionally, you will coordinate with partner teams to improve threat detection tuning, enrich data feeds, and enhance triage accuracy and timeliness through automation.

Responsibilities

• Analyze and investigate activity on company devices and cloud infrastructure that could represent a security threat.
• Work cross-functionally with Security teams to develop solutions for analyzing security events at scale and protecting Stripe networks, systems, and data.
• Interpret disparate data sources to report on trends and support investigative requests.
• Collect requirements for enhancements to detection models and response systems.
• Leverage existing systems and data to perform analyses and promote process improvements.
• Provide actionable insights to help identify, prevent, detect, and respond to anomalous or potentially malicious user activity.
• Collaborate effectively with teammates, lead projects, mentor others, and champion quality operational standards.

Requirements

Minimum Requirements

• 5+ years of experience in information technology or cybersecurity roles, including incident response.
• 2+ years of experience analyzing large datasets to solve problems and/or manage projects related to security event triage and/or workplace investigations.
• Prior experience investigating and triaging security threats on endpoint devices (Mac, Linux, Windows) and cloud infrastructure across AWS, Azure, and GCP.
• B.S. or M.S. in Cybersecurity and Information Assurance, Data Analytics, Computer Science, or related field, or equivalent experience.
• Working knowledge of SQL.
• Basic knowledge of scripting or programming in Python, Go, or other languages.
• Proven experience with log querying and analysis, digital forensics, or incident response using industry-standard SIEM platforms (e.g., Splunk, Sentinel, Elastic).
• Proficiency using analytical methods to inform detection systems or guide strategic response.
• Strong cross-functional collaboration and written/verbal communication skills.
• High level of judgment, objectivity, and discretion.

Preferred Qualifications

• Prior experience working with high-volume data in a security incident response environment.
• Experience with data processing and analysis tools (e.g., Jupyter Notebooks, Databricks).
• Adversarial mindset understanding threat actor goals, behaviors, and TTPs.
• Ability to leverage threat intelligence and hunting concepts in an enterprise environment.
• Experience with UEBA, SOAR/security automation, SIEM, DLP, Information Security, or Data Privacy.
• Security certifications from recognized industry providers (e.g., GIAC, ISACA, ISC2, OffSec, CompTIA).