The board
- Pay
- $139K – $191.4K
- Where
- San Francisco HQ
- Posted
- Apr 28
We believe that the way people interact with their finances will drastically improve in the next few years. We’re dedicated to empowering this transformation by building the tools and experiences that thousands of developers use to create their own products. Plaid powers the tools millions of people rely on to live a healthier financial life. We work with thousands of companies like Venmo, SoFi, several of the Fortune 500, and many of the largest banks to make it easy for people to connect their financial accounts to the apps and services they want to use. Plaid’s network covers 12,000 financial institutions across the US, Canada, UK and Europe.
What you'd do
- Lead investigations into complex fraud cases across identities, accounts, devices, and transaction surfaces
- Provide support to day-to-day fraud operations including SEVs and alert triage
- Reconstruct attacker sequences and hypothesize actor intent and tooling
- Distill patterns from noisy signals into clear narratives and actionable insights
- Bridge investigation outcomes to product and model improvements
- Operate across Plaid's fraud tooling — dashboards, alerting systems, network signals, and analytics platforms — to detect and validate anomalies
- Stress-test existing capabilities, identify systemic gaps, and define new detection primitives
- Proactively identify gaps in internal fraud tooling and automation, driving enhancements to improve efficiency and scale
- Collaborate with Data Science, ML/AI, and Product teams to improve labeling, feature sets, evaluation frameworks, and model decay monitoring
- Surface data quality limitations and systematically formalize missing features
What they want
- 3+ years of applied fraud experience in a high-velocity environment (fintech, consumer payments, banking, SaaS, marketplace risk, or security research)
- Investigator mindset: pattern synthesis, hypothesis testing, and skilled triage between signal and noise
- End-to-end investigation experience reconstructing attacker intent and behavior in multi-step attack sequences across accounts, devices, and identities
- Post-containment incident response experience with a deep emphasis on post-mortems and root cause analysis
- Dark and grey-web navigation and investigation experience; ability to assess source credibility and translate external intelligence into actionable insights
- Strong communication: ability to explain complex, ambiguous behavior to technical and non-technical audiences
- Tool fluency with data environments and investigative toolchains (BI tools, anomaly detection, case trackers)