Fraud Strategist - Login and Auth

Employee Applicant Privacy Notice Who we are: Shape a brighter financial future with us. Together with our members, we’re changing the way people think about and interact with personal finance. We’re a next-generation financial services company and national bank using innovative, mobile-first technology to help our millions of members reach their goals. The industry is going through an unprecedented transformation, and we’re at the forefront. We’re proud to come to work every day knowing that what we do has a direct impact on people’s lives, with our core values guiding us every step of the way. Join us to invest in yourself, your career, and the financial world. The Role: We are searching for a Fraud Strategist, Login and Auth to own the perimeter of the SoFi platform. This is a sophisticated role at the intersection of adversarial threat intelligence, device forensics, and real-time decisioning. You will design fraud strategy across login, password reset, MFA, step-up, and high-risk session events, calibrated against the full spectrum of perimeter threats: account takeover (ATO), authorized scams, credential stuffing, MFA bombing, OTP interception, SIM swap, adversary-in-the-middle phishing, and emulator-driven bot traffic. The work requires fluency in device intelligence,, behavioral biometrics, network reputation, and the device-graph forensics needed to attribute risk to entities, not just sessions. You will work cross-functionally with EPD, IAM, Fraud Ops, InfoSec, and partner risk teams to translate signals into production policy that scales across Money, Invest, Crypto, Card, and Lending. By joining SoFi, you'll become part of a forward-thinking company that is transforming financial services for the better. We offer the excitement of a rapidly growing startup with the stability of an industry leading leadership team. What You'll Do: The Fraud Strategist, Login and Auth will help SoFi build a defensible authentication perimeter by: Owning the end-to-end login risk strategy across web and mobile authentication surfaces: signal selection, rule construction, threshold tuning, champion/challenger lifecycle, and rule-level loss attribution. Architecting perim eter-threat defense covering ATO, scam interception (authorized push payment, remote access, impostor, investment), MFA bombing, OTP interception, SIM swap, and adversary-in-the-middle phishing. Translate live campaign telemetry into production rule changes within hours