# Principal Software Engineer, Anti-Abuse **Company:** [Snowflake](https://scaleengineer.com/companies/snowflake) Principal Software Engineer leading Snowflake's Anti-Abuse team to architect platform-wide fraud detection and abuse prevention systems protecting multi-cloud infrastructure. Requires 12+ years of distributed systems and security engineering experience with proven expertise in building scalable detection engines, designing runtime controls, and threat modeling across cloud platforms serving millions of queries and transactions. **Role:** Principal Engineer **Seniority:** Principal **Locations:** US-WA-Bellevue **Salary:** 264000–379500 USD [Apply](https://jobs.ashbyhq.com/snowflake/797cadbe-fad8-4f1d-a656-d14ca76d29b9) Canonical: https://scaleengineer.com/jobs/snowflake/principal-software-engineer-anti-abuse --- ## Responsibilities - Define Long-Term Anti-Abuse Technical Vision: Establish and drive the strategic technical roadmap for abuse and fraud detection across the entire Snowflake platform, serving as the chief architect overseeing platform-wide anti-abuse initiatives and setting the technical direction for the organization - Partner on High-Risk Product Surfaces: Collaborate closely with product and engineering teams building Snowflake's newest and highest-risk capabilities including Snowpark user code execution runtimes, Data Sharing and Marketplace, and Cortex AI services to design and deploy robust anti-abuse controls from initial conception through production deployment - Architect High-Throughput Telemetry and Scoring Systems: Design and scale mission-critical telemetry pipelines and risk-scoring engines capable of processing millions of queries, sessions, and data transactions with low-latency analysis across multi-cloud environments including AWS, Azure, and GCP - Model and Anticipate Emerging Threat Vectors: Continuously research and model evolving abuse techniques including trial compute abuse, cryptocurrency mining, bot-driven account creation, credential stuffing, account takeover, and illicit network traffic routing to stay ahead of malicious actors - Design Intelligent Mitigation Systems: Architect and implement automated mitigation systems capable of throttling, challenging, or isolating abusive workloads and malicious actors with near-zero false-positive impact on legitimate enterprise workloads and customer operations - Lead Technical Culture and Mentorship: Elevate technical standards across the engineering organization through active mentorship of staff and senior engineers, influence architectural decisions on adjacent platform teams, and foster a culture of security-first thinking in distributed systems design ## Requirements ### education - {"name":"Bachelor's Degree in Computer Science or Related Field","description":"B.S. in Computer Science, Computer Engineering, Cybersecurity, or equivalent discipline"} - {"name":"Advanced Degree (Preferred)","description":"M.S. or Ph.D. in Computer Science, Computer Engineering, Cybersecurity, or related field, or equivalent 12+ years of hands-on practical engineering experience demonstrating advanced expertise"} ### technical - {"name":"Distributed Systems Architecture","description":"Proven expertise architecting mission-critical, large-scale distributed services with deep understanding of scalability, fault tolerance, and consistency patterns across cloud infrastructure"} - {"name":"Fraud Detection and Anomaly Detection Systems","description":"Demonstrated ability to build streaming event processing systems, behavioral heuristic engines, graph-based syndicate detection systems, and machine learning-based anomaly detection at enterprise scale"} - {"name":"Runtime Security and Control Design","description":"Deep experience designing security controls for code-execution runtimes, multi-tenant compute environments, cloud APIs, and data platforms with focus on mitigating compute hijacking, sandbox escapes, serverless function abuse, and network egress threats"} - {"name":"Multi-Cloud Platform Operations","description":"Production experience designing and operating detection and response systems across multiple cloud providers simultaneously, with understanding of AWS, Azure, and GCP platform-specific security considerations"} - {"name":"Programming Languages Proficiency","description":"Strong proficiency in Java, C++, or Python for building scalable backend systems, with ability to evaluate and select appropriate languages for performance-critical infrastructure components"} ### experience - {"name":"Senior-Level Distributed Systems Engineering","description":"12+ years of software engineering experience specifically in distributed systems, cloud platform infrastructure, or security engineering with demonstrated ability to architect enterprise-scale solutions"} - {"name":"Anti-Abuse and Fraud Detection Specialization","description":"Significant time dedicated to anti-abuse systems, fraud detection, platform trust and safety, or threat mitigation initiatives, with proven track record of shipping production systems that scaled to protect millions of users"} - {"name":"Threat Modeling and Attack Economics","description":"Strong intuition for attacker economics, mechanics, and behavior patterns with hands-on experience modeling comprehensive threat vectors across account lifecycles including signup, trial account abuse, payment fraud, execution layer attacks, and data sharing misuse"} - {"name":"Cross-Functional Technical Leadership","description":"Proven ability to partner effectively with product managers, infrastructure engineers, and security researchers to embed safety controls into high-velocity product roadmaps while maintaining security standards"} ## Skills ### required - {"name":"Distributed Systems Design","description":"Architecting scalable, resilient systems handling massive throughput with low-latency requirements across cloud infrastructure"} - {"name":"Java, C++, or Python","description":"Production-level expertise in at least one of these languages for building high-performance backend systems and microservices"} - {"name":"Streaming Data Processing","description":"Building and operating event streaming pipelines for real-time data analysis at scale using technologies like Kafka or similar platforms"} - {"name":"Anomaly Detection Algorithms","description":"Designing behavioral heuristic engines and statistical methods to identify unusual patterns and potential fraudulent activities in large datasets"} - {"name":"Platform Security Architecture","description":"Designing defense-in-depth security controls for cloud platforms with focus on multi-tenancy, access control, and threat isolation"} - {"name":"Multi-Cloud Infrastructure","description":"Practical experience with AWS, Azure, and GCP platforms including their security models, networking, and compute services"} - {"name":"Threat Modeling","description":"Systematic approach to identifying, analyzing, and prioritizing security threats against complex systems and emerging attack vectors"} ### preferred - {"name":"Multi-Tenant SaaS Platform Security","description":"Hands-on experience building anti-abuse systems specifically designed for multi-tenant cloud platforms or SaaS environments at scale"} - {"name":"AI/LLM Security","description":"Understanding of emerging security challenges with AI and large language models including prompt injection, model extraction attacks, and automated content generation for fraud"} - {"name":"Zero-Trust Architecture","description":"Designing and implementing zero-trust or defense-in-depth architectural patterns for compute runtimes and security-critical systems"} - {"name":"Published Security Research","description":"Track record of published research papers, industry contributions, speaking engagements, or thought leadership in fraud detection, adversarial machine learning, or platform trust and safety"} - {"name":"Graph-Based Detection Systems","description":"Experience building graph databases and algorithms for detecting complex abuse patterns, fraud rings, and organized malicious activity"} - {"name":"Machine Learning for Security","description":"Applying machine learning and statistical models for fraud detection, anomaly detection, and predictive threat intelligence"} ## Tech stack ### tools - {"name":"AWS, Azure, GCP","description":"Multi-cloud platform experience for designing systems that operate across different cloud providers simultaneously"} - {"name":"Kubernetes or Container Orchestration","description":"Deploying and scaling microservices across multi-cloud environments with high availability requirements"} - {"name":"Monitoring and Observability Tools","description":"Real-time system monitoring, logging, and distributed tracing for production systems handling millions of transactions"} - {"name":"Machine Learning Frameworks","description":"TensorFlow, PyTorch, scikit-learn for building anomaly detection and behavioral analysis models"} ### others - {"name":"Snowflake Platform","description":"Deep understanding of Snowflake's architecture, including Snowpark, Data Sharing, and Cortex AI services and their security implications"} - {"name":"Security Engineering Practices","description":"Threat modeling, risk assessment, security architecture review, and defense-in-depth design principles"} - {"name":"DevOps and Infrastructure as Code","description":"Terraform, CloudFormation, or similar tools for infrastructure automation and reproducible deployments"} ### databases - {"name":"Time-Series Databases","description":"Efficient storage and querying of temporal telemetry data for trend analysis and historical pattern detection"} - {"name":"Graph Databases","description":"Modeling relationships between users, accounts, and behaviors for detecting complex fraud patterns and abuse rings"} - {"name":"NoSQL Databases","description":"Handling high-throughput, unstructured event data from across the Snowflake platform"} ### languages - {"name":"Java","description":"Enterprise-grade systems development for distributed backends and microservices at scale"} - {"name":"Python","description":"Data analysis, machine learning model development, and infrastructure automation for detection systems"} - {"name":"C++","description":"Performance-critical components requiring low-latency execution and high-throughput processing"} ### frameworks - {"name":"Apache Kafka or Similar Streaming Platforms","description":"Real-time event streaming and processing for telemetry pipelines handling millions of events per second"} - {"name":"Microservices Architectures","description":"Designing and operating distributed service-oriented systems with independent deployment and scaling"} - {"name":"GraphQL or REST APIs","description":"Exposing detection and response capabilities to other platform services and internal tools"} ## Benefits ### benefits - {"name":"Comprehensive Health Coverage","description":"Medical, dental, and vision insurance with company-paid premiums for employees and subsidized coverage for dependents"} - {"name":"Equity and Stock Options","description":"Substantial equity grants and stock option plans enabling meaningful ownership stake in Snowflake's continued growth and success"} - {"name":"Retirement Planning","description":"401(k) plan with company matching contributions to support long-term financial security"} - {"name":"Flexible Work Environment","description":"Hybrid work flexibility accommodating both in-office collaboration and remote work arrangements"} - {"name":"Professional Development","description":"Learning budgets, conference attendance support, and internal technical training programs to accelerate skill development"} - {"name":"Time Off Policy","description":"Generous paid time off, unlimited PTO options, and paid parental leave supporting work-life balance"} - {"name":"Performance Bonuses","description":"Annual performance-based bonus programs tied to individual and company achievements"} - {"name":"Wellness Programs","description":"Mental health support, fitness programs, and wellness initiatives promoting employee well-being"} ## Compensation - **max:** 350000 - **min:** 250000 - **currency:** USD - **stockOptions:** true ## Interview process ### steps - {"name":"Initial Screening Call","description":"Brief conversation with recruiting team to discuss background, experience with anti-abuse systems or fraud detection, and alignment with role requirements and team culture"} - {"name":"Technical Deep Dive Interview","description":"Comprehensive discussion with engineering leadership covering distributed systems architecture, fraud detection approaches, threat modeling methodology, and specific examples of systems you've designed and shipped at scale"} - {"name":"System Design Assessment","description":"Whiteboarding or detailed technical discussion architecting an abuse detection system for a specific threat scenario, evaluating your approach to scalability, latency requirements, false-positive management, and multi-cloud considerations"} - {"name":"Security and Threat Modeling Exercise","description":"Collaborative session with security engineers and product team members to identify threat vectors in a hypothetical product scenario and design appropriate controls and mitigations"} - {"name":"Cross-Functional Leadership Discussion","description":"Conversation with product managers, infrastructure leaders, and security researchers to assess your ability to collaborate, influence architectural standards, and embed safety considerations into product roadmaps"} - {"name":"Executive Alignment Meeting","description":"Discussion with executive leadership or hiring manager covering long-term vision for anti-abuse at Snowflake, your approach to technical strategy, and how you approach scaling teams and mentoring senior engineers"} ## Full description At Snowflake, we are powering the era of the agentic enterprise. To usher in this new era, we seek AI-native thinkers across every function who are energized by the opportunity to reinvent how they work. You don’t just use tools; you possess an innate curiosity, treating AI as a high-trust collaborator that is core to how you solve problems and accelerate your impact. We look for low-ego individuals who thrive in dynamic and fast-moving environments and move with an experimental mindset — who rapidly test emerging capabilities to discover simpler, more powerful ways to deliver results. At Snowflake, your role isn't just to execute a function, but to help redefine the future of how work gets done. We are hiring a Principal Software Engineer for our Anti-Abuse team. The Anti-Abuse team sits at the core of protecting Snowflake and our customers from abuse on the Snowflake Platform. We strive to see the complete picture, leading platform-wide abuse and fraud detection while designing and deploying proactive controls for Snowflake's highest-risk capabilities: Snowpark, Data Sharing, Cortex AI, and the next generation of cloud engineering challenges as Snowflake rapidly scales. In this role, you will be the lead technical architect responsible for defining and driving our technical strategy for abuse prevention, detection, and response across the entire Snowflake ecosystem. ## AS A PRINCIPAL SOFTWARE ENGINEER, ANTI-ABUSE AT SNOWFLAKE, YOU WILL: * Define and drive the long-term technical vision for abuse and fraud detection across the Snowflake platform, serving as the chief architect for platform-wide anti-abuse strategy * Partner directly with product and engineering teams building Snowflake's newest and highest-risk surfaces (Snowpark user code execution runtimes, Data Sharing and Marketplace, AI/LLM services) to design and deploy robust anti-abuse controls from day one * Architect and scale high-throughput, low-latency telemetry pipelines and risk-scoring engines capable of analyzing millions of queries, sessions, and data transactions across multi-cloud environments (AWS, Azure, GCP) * Continuously model emerging abuse techniques, including trial compute abuse, cryptocurrency mining, bot-driven account creation, credential stuffing, and illicit network traffic routing * Design intelligent mitigation systems that automatically throttle, challenge, or isolate abusive workloads and malicious actors with near-zero false-positive impact on legitimate enterprise workloads * Raise the technical bar across the engineering organization through mentorship of staff and senior engineers, and influence architectural standards across adjacent platform teams ## OUR IDEAL PRINCIPAL SOFTWARE ENGINEER, ANTI-ABUSE WILL HAVE: * 12+ years of software engineering experience in distributed systems, cloud platform infrastructure, or security engineering, with significant time dedicated to anti-abuse, fraud detection, platform trust, or threat mitigation * Proven track record architecting mission-critical, large-scale distributed services in Java, C++, or Python * Deep experience designing controls for code-execution runtimes, multi-tenant compute environments, cloud APIs, or data platforms (e.g., mitigating compute hijacking, sandbox escapes, abuse of serverless functions, or network egress abuse) * Demonstrated ability to build streaming event processing, anomaly detection, behavioral heuristic engines, or graph-based syndicate detection systems at enterprise scale * Strong intuition for attacker economics and mechanics, with experience modeling threat vectors across account lifecycles (signup, trial, payment, execution, sharing) * Exceptional ability to partner with product managers, infrastructure teams, and security researchers to embed safety controls into high-velocity product roadmaps * B.S., M.S., or Ph.D. in Computer Science, Computer Engineering, Cybersecurity, or equivalent practical experience ## BONUS POINTS FOR THE FOLLOWING: * Experience building anti-abuse systems for multi-tenant cloud platforms or SaaS-at-scale environments * Familiarity with AI/LLM abuse vectors (prompt injection, model extraction, automated content generation for fraud) * Track record of designing zero-trust or defense-in-depth architectures for compute runtimes * Published research or industry contributions in fraud detection, adversarial ML, or platform trust and safety * Experience operating detection and response systems across multiple cloud providers simultaneously ## WHY JOIN OUR ANTI-ABUSE TEAM AT SNOWFLAKE? The Anti-Abuse team works at the intersection of platform security, distributed systems, and adversarial thinking. You will own the technical strategy for protecting one of the world's fastest-growing cloud platforms from novel and evolving threats. This is not a compliance checkbox role: you will architect real-time detection systems, embed native guardrails into new product primitives before they reach production, and partner directly with engineering leaders across the organization to anticipate threats no one else is seeing yet. If you want to build the immune system for the agentic enterprise, this is the role. Snowflake is growing fast, and we’re scaling our team to help enable and accelerate our growth. We are looking for people who share our values, challenge ordinary thinking, and push the pace of innovation while building a future for themselves and Snowflake. How do you want to make your impact? For jobs located in the United States, please visit the job posting on the Snowflake Careers Site for salary and benefits information: [careers.snowflake.com](http://careers.snowflake.com)