Staff Software Engineer (Fraud)

Join Replit's Fraud team as a Staff Software Engineer. You'll be on the front lines of defending our platform from exploitation, detecting and shutting down phishing deployments, preventing cryptomining, and stopping LLM token farming. This unique role allows you to work on AI-native problems, applying AI to security challenges in a production environment. You'll own the entire abuse response lifecycle, from detection to enforcement, and collaborate with various teams across the company.

• Design and implement LLM guardrails that detect abuse scenarios in AI-generated code and agent interactions.
• Build AI-powered detection systems that use LLMs to identify malicious patterns, classify threats, and automate response decisions.
• Own the full abuse response lifecycle: detection, investigation, enforcement, and handling appeals alongside Support and Legal.
• Strong programming skills in Python and/or TypeScript for building detection systems and automation
• Familiarity with common attack patterns: phishing infrastructure, account takeover, credential stuffing, resource abuse
• 8+ years of experience in security engineering, anti-abuse, trust & safety, or fraud detection
• Experience with SQL and data analysis at scale (BigQuery, Snowflake, or similar)
• Experience building or fine-tuning ML/LLM-based classifiers for security or abuse detection
• Familiarity with prompt injection, jailbreaking, and other LLM-specific attack vectors
• Ability to investigate complex abuse patterns and translate findings into automated defenses
• Clear communication skills for working across Security, Support, Legal, and Engineering teams
• Experience at a platform company dealing with user-generated content or compute abuse (hosting providers, cloud platforms, developer tools)
• Background in fraud detection, payment abuse, or financial crime
• Familiarity with device fingerprinting, IP reputation, and email validation services
• Experience with CI/CD security tooling (SAST, SCA, Dependabot, Snyk)
• Knowledge of container security, Linux internals, or cloud infrastructure (GCP preferred)
• Prior work with abuse reporting pipelines, trust & safety tooling, or content moderation systems