Principal Fraud Strategist, Authentication and Device Trust

Employee Applicant Privacy Notice

Who we are:

The role

We are searching for a Principal Fraud Strategist to own SoFis authentication and device trust discipline end to end. This is a sophisticated platform-level role at the intersection of adversarial threat intelligence device intelligence and risk decisioning architecture. You will design the layered defense that protects every member session at SoFi: login password reset MFA step-up account recovery and high-risk transaction moments across web and mobile. You will own device trust outright: identification recognition intelligence entity resolution and the signal development work that keeps SoFi ahead of ATO scam and perimeter attack patterns as they evolve. The role spans strategy orchestration and vendor stack design (Transmit Security Mosaic and beyond) and scales across Money Invest Crypto Card and Lending. You will work cross-functionally with EPD IAM Fraud Ops InfoSec Product and Data Science and influence vendor roadmaps where SoFis needs run ahead of what the market ships.

By joining SoFi youll become part of a forward-thinking company that is transforming financial services for the better. We offer the excitement of a rapidly growing startup with the stability of an industry leading leadership team.

What youll do:

The Principal Fraud Strategist Authentication and Device Trust will help SoFi build and continuously evolve a layered authentication and device trust defense by:

• Owning end-to-end strategy for authentication and device trust across web and mobile: signal architecture decisioning topology rule construction threshold tuning champion/challenger lifecycle and rule-level loss and false-positive attribution.

• Architecting the layered perimeter defense against ATO scam interception (authorized push payment remote access impostor investment business email compromise) credential stuffing MFA bombing OTP interception SIM swap adversary-in-the-middle phishing and emulator-driven bot traffic. Convert live campaign telemetry into policy changes at the speed of the attack.

• Owning the device trust discipline: device identification recognition and intelligence across web and mobile; behavioral biometrics; network reputation; device-graph and entity resolution; emulator and VM detection; jailbreak and root signals; residential-proxy detection; and signal development for gaps the current vendor stack does not cover.

• Orchestrating the vendor stack that underpins authentication and device trust (Transmit Security Mosaic and adjacent providers): capability assessment integration design data flow architecture decision timing and continuous performance tuning. Influence vendor roadmaps where SoFi has needs the market has not yet met.

• Designing step-up authentication account recovery and high-risk transaction decisioning that synthesizes device behavioral network and credential-risk signals into a single decision with explicit FPR budgets per surface. Keep controls invisible to legitimate members wherever possible.

• Leading 3DS CNP and tokenization decisioning for card-not-present transactions coordinating with issuer processing and network rules to optimize approval rate without ceding losses.

• Partnering with InfoSec threat intelligence on credential-capture campaigns phishing kits SEO poisoning and ATO-as-a-service marketplaces. Translate intelligence into rule changes inside the live policy stack and into new signal development priorities.

• Setting the technical bar for how SoFi builds durable fraud defense. Mentor the broader fraud strategy organization on authentication device intelligence and adversarial reasoning.

What youll need:

• BA/BS in Statistics Information Systems Mathematics Data Science Computer Science or related fields or equivalent work experience and 15 years of work experience in Fraud Strategy Authentication Risk Device Intelligence or Adversarial Security Engineering.

• ATO and Scam Defense: Deep track record reducing account takeover and scam losses across banking card crypto and P2P surfaces. Fluency across the full kill chain: credential exposure login compromise in-session manipulation (remote access screen share social engineering) and money movement out.

• Perimeter Threat Fluency: Operational understanding of credential stuffing MFA bombing OTP interception SIM swap adversary-in-the-middle phishing residential-proxy abuse and emulator-driven automation. You have recognized campaigns in flight from telemetry and responded at the policy layer more than once.

• Device Intelligence and Forensics: Hands-on architectural experience with device identification recognition and intelligence platforms. Fluency in device fingerprinting emulator and VM detection jailbreak and root signals behavioral biometrics and entity-level device-graph analysis. Direct experience with Transmit Security Mosaic Iovation ThreatMetrix BioCatch or comparable platforms as a builder not just a consumer.

• Signal Development: Proven ability to identify signal gaps in production systems and develop new signals either directly or in partnership with vendors that close them. You do not wait for a vendor to invent the detection you need.

• Risk Architecture and Vendor Orchestration: Track record designing holistic fraud systems across multiple vendors data feeds and decisioning layers with clear ownership of decision timing feedback loops metrics and incident response paths.

• Authentication Stack Depth: Working knowledge of FIDO2/passkeys OAuth/OIDC 3DS protocol mechanics tokenization and the trade-offs between approval rate and chargeback exposure on CNP flows.

• Balance Friction and Growth: Deep mastery of evaluating trade-offs between fraud mitigation and UX. Keeps controls invisible to legitimate members wherever possible and spends friction judiciously where it delivers the greatest incremental protection.

• Architect Scalable Data Systems: Expert-level SQL/Python skills used to build automated high-volume data architectures and statistical models that serve as the foundation for global risk detection.

• Drive Strategic Influence: A proactive leader who uses cross-functional persuasion to align EPD IAM InfoSec Fraud Ops and vendor partners on strategy changes and owns end-to-end execution in fluid environments.

• Founders Mentality: You need to have a positive proactive attitude being able to identify problems raise proposals and be an advocate of your initiatives. Learn iterate and excel.