Staff+ Software Engineer, Account Compromise

Job summary

ABOUT Ant*** Ant***’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems.

Benefits

Qualifications

• 10 + years experience designing, building, and operating detection, anti-fraud, anti-abuse, or security systems in production
• A track record of independently scoping and delivering complex, ambiguous, multi-month technical projects
• Experience making architectural decisions in an adversarial domain that other engineers and teams then build on
• Proficiency in Python and SQL, with strong software engineering fundamentals and hands-on coding ability
• Experience leading investigations into account-based abuse or security incidents, and translating findings into automated detection
• Ability to reason rigorously about large behavioural or telemetry datasets, and to distinguish attacker behaviour from unusual but legitimate use
• Strong written communication and a track record of driving alignment across multiple teams and stakeholders
• Sound judgement about the tradeoff between stopping bad actors and disrupting legitimate users, and the ability to explain and defend where you have drawn that line
• PREFERRED
• Significant engineering experience in trust and safety, platform integrity, fraud, or detection and response, including time as a technical lead or mentor
• Deep familiarity with account attack techniques
• Experience with authentication and identity systems, including OAuth, single sign-on, multi-factor authentication, device binding, and risk-based authentication

Responsibilities

• You will own the architecture of how we detect, contain, and remediate account compromise across Claude and the Claude Developer Platform, making the design decisions that other engineers and teams build on top of.
• You will be building the playbook, and the judgement calls about where to draw those lines will largely be yours to make and defend.
• Set the technical direction and own the architecture for account compromise detection, response, and remediation across Claude and the Claude Developer Platform
• Independently scope and lead complex, multi-month engineering projects from an ambiguous starting point through to production systems that operate reliably under adversarial pressure
• Build and evolve detection systems that identify account takeover, credential abuse, and compromised API keys in near real time
• Design automated response flows that cut off attacker access while minimising disruption to legitimate users
• Lead investigations into significant compromise incidents end to end, then convert what you learn into durable, automated defences
• Threat model how attackers are likely to adapt, and prioritise the team's work against that view rather than only against incidents already observed
• Drive cross-organisational alignment on account security direction with Security, Product, Support, Policy and other partners.
• Define how the team measures success and hold the work to those measures
• Set technical standards for the domain and raise the bar for other engineers through code review, design review, and mentorship
• Surface patterns from compromise cases to research and product teams so that protections improve upstream

Skills

Degrees

Industry