Higgsfield

Why work at Higgsfield AI? Higgsfield AI is the fastest-scaling generative AI company in history, hitting $1B in annual revenue run rate, 30M+ users worldwide, 6M+ generations per day, and powering 390 of Fortune 500 brands. We're building at the absolute frontier of AI-powered video creation and next-generation creative tools. Joining Higgsfield means becoming part of a high-impact team shaping the future of AI-native experiences, at a company that isn't just moving fast, but rewriting what fast looks like. About the role: Higgsfield AI is looking for a highly technical, hands-on ML Security Engineer to join Higgsfield Security and own security across our GPU clusters and AI/ML infrastructure, from model training to inference and production deployment. In this role, you will work as part of the Security team and closely with our ML and Infrastructure teams to design, implement, and operate security controls that protect models, data, and underlying infrastructure. Your core responsibilities will include securing GPU compute environments, assessing infrastructure and AI/ML vendors, and enforcing security requirements through technical controls, deployment policies, and verified remediation. We're looking for someone who combines deep security engineering expertise with a practical, solutions-oriented mindset. The ideal candidate is comfortable working across cloud environments, Kubernetes, Linux, and GPU infrastructure, and understands how to balance security, performance, and reliability in a fast-moving AI environment. This role carries direct ownership of GPU infrastructure security and the security requirements that third-party providers must meet to support Higgsfield’s workloads and data. What you'll do: AI/ML &amp; GPU Infrastructure Security<ul><li>Own the security of GPU clusters supporting distributed training and production inference across cloud and rented datacenter environments.</li><li>Harden GPU hosts, operating systems, drivers, container runtimes, Kubernetes clusters, and workload scheduling configurations; reduce privileged access and unnecessary exposure.</li><li>Secure distributed training environments and GPU workloads through isolation, access controls, and data movement restrictions. Validate isolation between tenants and workloads across compute, networking, and storage, including shared GPU environments where applicable.</li><li>Design and implement controls to protect sensitive datasets, model checkpoints, weights, and customer data.</li><li>Strengthen inference security through tenant isolation, service authorization, secure model loading.</li><li>Partner with ML and Platform Engineering teams to integrate security into infrastructure design and development workflows.</li></ul>Vendor Security Assessment &amp; Enforcement<ul><li>Lead technical security assessments of GPU infrastructure providers, datacenter operators, and other AI security vendors that process Higgsfield data and support AI workloads.</li><li>Evaluate vendor architecture and evidence covering tenant isolation, privileged access, data handling and retention, use of customer data for model training, encryption, vulnerability management, and incident response.</li><li>Translate security requirements into enforceable technical controls, including approved configurations, and continuous checks for configuration drift.</li><li>Track internal and vendor security findings to closure with accountable owners and deadlines, validate remediation, and escalate unmet requirements. Document any approved exceptions with compensating controls and expiration dates.</li></ul>Cloud &amp; Platform Security<ul><li>Design, implement, and maintain security controls across Linux, Kubernetes, cloud infrastructure, networks, and third party datacenter environments.</li><li>Secure infrastructure provisioning, configuration management, and access to third-party infrastructure providers. Restrict and audit vendor and administrator access to cluster management interfaces and production systems.</li><li>Implement least-privilege access, workload identity, secrets management, encryption, and auditable access controls.</li><li>Identify and remediate vulnerabilities and configuration risks across production systems, including GPU hosts, drivers, and container runtimes, coordinating changes with infrastructure owners to maintain service reliability.</li></ul>Security Operations &amp; Risk Management<ul><li>Develop and maintain detection and response capabilities for infrastructure and AI-specific security threats, including unauthorized GPU workloads, privilege escalation, and suspicious data transfers.</li><li>Investigate and respond to potential credential compromise, unauthorized data access, model theft, and compromised workloads.</li><li>Partner cross-functionally to implement practical security improvements that account for the performance, scalability, and reliability requirements of GPU workloads.</li></ul>Requirements:<ul><li>Strong hands-on experience in Security Engineering, Infrastructure Security, Platform Security, or a related technical discipline.</li><li>Deep understanding of Linux, Kubernetes, networking, and cloud infrastructure security.</li><li>Practical experience securing or operating GPU clusters or distributed AI/ML infrastructure, with an understanding of training and inference workloads, GPU drivers and runtimes, and workload isolation.</li><li>Experience designing and implementing security controls across complex, distributed production environments.</li><li>Strong knowledge of identity and access management, workload isolation, encryption, secrets management, and least-privilege principles.</li><li>Experience conducting technical vendor security assessments, evaluating supporting evidence, and driving remediation with external providers.</li><li>Ability to identify, investigate, and remediate security vulnerabilities and infrastructure threats.</li><li>Proficiency in scripting or programming languages such as Python, Go, or Bash.</li><li>Experience partnering with Infrastructure, Platform, or ML Engineering teams to implement security solutions.</li><li>Strong technical ownership, sound judgment, and the ability to prioritize security risks in a fast-paced environment.</li><li>A hands-on, collaborative approach with the ability to independently drive security initiatives from design through deployment, verify that controls work in production, and hold internal teams and vendors accountable for agreed security requirements. </li></ul>Compensation &amp; Benefits<ul><li>We offer a competitive and thoughtfully structured compensation package designed to align with impact, experience, and long-term growth.</li><li>Base Salary: The anticipated salary range for this role is $200,000 - $300,000, depending on experience, skills, scope, and location.</li></ul> • Bonus: This role is Bonus eligible and may participate in the Company's discretionary annual bonus program.<ul><li>Equity: In addition to cash compensation, employees are eligible to participate in the company’s stock option program and share in Higgsfield’s long-term growth.</li><li>Benefits: We offer a comprehensive benefits package designed to support employees professionally and personally, including medical, dental, and vision insurance, a competitive 401(k) retirement plan with company matching, and additional benefits and perks.</li><li>The opportunity to work on ambitious AI products alongside a highly experienced, fast-moving, and international team.</li><li>Significant ownership, direct impact, and opportunities for professional growth as the company scales.</li></ul>This is a hybrid role based in the San Francisco Bay Area. Team members are expected to work from our San Francisco office three full days per week, with the remaining days worked remotely and are expected to be available during agreed working hours and to maintain sufficient overlap with the relevant team’s time zone. We value in-person collaboration, active communication, responsiveness, and close partnership across teams.Higgsfield AI is an equal opportunity employer. We are committed to building a diverse and inclusive team and do not discriminate on the basis of race, color, religion, sex, gender identity or expression, sexual orientation, national origin, age, disability, veteran status, or any other protected characteristic.

Security Engineer, ML Infrastructure

Almaty, Kazakhstan · Trust &amp; Safety Engineering Why this role existsAn agent needs more than a model response to complete useful work. It needs tools, durable execution, permissions, context, and a way to recover when something fails. You'll build the backend that lets Higgsfield agents carry creative tasks from a user's request to a finished result. We're looking for an engineer we can trust with a problem: work out what is worth building, build it, and carry it through to users.What you'll actually do<ul><li>Agent execution: build orchestration for multi-step tasks, tool calls, streaming updates, and cancellation.</li><li>Durable workflows: implement checkpoints, resumability, retries, and recovery without duplicating actions.</li><li>Tools and integrations: connect agents to generation, editing, and external services through clear, validated interfaces.</li><li>Execution boundaries: enforce user permissions, tenant isolation, resource limits, and approval requirements for consequential actions.</li><li>Evaluation and observability: trace failures, build regression cases, and improve task completion, latency, and cost.</li><li>Ownership: understand a real user task → define success and build evaluation cases → scope the simplest useful workflow → ship → measure completion, reliability, and dollar impact → improve from failed runs. Our release cycle is days, not quarters, so your first shipped agent capability happens fast.</li></ul>Must-haves<ol><li>You've taken a difficult problem from an unclear starting point to a working system used in production, and can explain your own decisions, contribution, and results.</li><li>You can build reliable agent execution: state machines, concurrency, queues, recovery, model APIs, secure tool calls, and repeatable evaluations. You learn unfamiliar tools quickly and understand what you ship.</li><li>You choose the next steps, remove blockers, and ask for help when needed. You cut scope to test an idea, adapt from evidence, and keep working through difficult problems.</li><li>You investigate real user tasks and failed agent runs, use feedback to choose what to automate, and stop workflows that do not help users finish their work.</li><li>You take feedback, change your mind when the evidence changes, and do the work the team needs. You share knowledge and responsibility so others can operate and extend what you build.</li></ol>Who this is not for<ul><li>You prefer deterministic application behavior without investigating model uncertainty.</li><li>You prefer prototyping without owning evaluation, recovery, and production reliability.</li></ul>Nice to have<ul><li>Production agents, workflow engines, or developer tools.</li><li>High-throughput systems with heavy traffic, large data volumes, or many long-running jobs.</li><li>Agent context management, memory, subagents, or parallel tool calls.</li><li>Sandboxed execution and scoped authorization.</li><li>Multimodal workflows involving images, video, or audio.</li></ul>Interview process<ol><li>Recruiter screen: role expectations, logistics, and fit.</li><li>Technical interview: a difficult system you shipped, what you personally decided and built, and how your work made the team more capable without leaving it dependent on you.</li><li>Additional technical interview, if needed: a deeper discussion of technical skills and open questions.</li><li>Product fit interview: scope a useful tool-using workflow, evaluate failures, and explain when user feedback would lead you to change or stop it.</li><li>Offer.</li></ol>What we offerCompetitive base in USD, equity, relocation support, and ownership of systems that turn AI capabilities into completed creative work.

Backend Software Engineer, Agentic

<h2>Why work at Higgsfield AI?</h2>Higgsfield AI is the fastest-scaling generative AI company in history, hitting $1B in annual revenue run rate, 30M+ users worldwide, 6M+ generations per day, and powering 390 of Fortune 500 brands.We're building at the absolute frontier of AI-powered video creation and next-generation creative tools. Joining Higgsfield means becoming part of a high-impact team shaping the future of AI-native experiences, at a company that isn't just moving fast, but rewriting what fast looks like. <h2>What This Role Means at Higgsfield</h2>Most subscription businesses lose a password. We lose GPU-seconds.When someone runs two hundred accounts off one card to harvest a per-account promotional grant, the cost lands on our compute bill the same hour, and it does not stop until somebody finds them. We have found operators doing exactly that — hundreds of accounts, synchronised signups, machine- generated emails, round-the-clock automation — and we have also found that most of our worst- margin accounts are not abusers at all, just heavy users on an unlimited plan. Telling those two apart, account by account, with evidence that survives being challenged, is this job.You are the person who finds them, proves it, and puts a number on it.You make sure:<ul><li>Every enforcement action we take is backed by evidence a stranger could follow</li><li>We know what abuse cost us last month, on the same basis as last month</li><li>The detection system is measured against real cases, not against its own past decisions</li><li>When a ring changes shape, somebody notices this week — and that somebody is you</li></ul><h2>What You Will Do</h2>Investigation &amp; casework<ul><li>Run ring investigations end to end: from a flagged account or a cost anomaly to a named cluster, its members, its signature, its lifetime economics and a recommended action.</li><li>Build the linkage yourself — shared payment instruments, IP and ASN concentration, email-stem families, registration bursts, behavioural and automation fingerprints — and know which links are evidence and which are coincidence.</li><li>Separate abuse from unprofitable-but-legitimate every single time. On an unlimited plan, negative gross margin is normal. Cost is a gate, never a trigger.</li><li>Triage the review queue the detection system produces, and feed what you learn back into it. Your adjudications are the only unbiased labels the scientist has.</li></ul>Evidence &amp; defensibility<ul><li>Produce evidence packages that hold up outside the company — to an external auditor, to a payment network, to a customer disputing a ban, to Legal enforcing our Terms. Our abuse work has already been used in all four contexts.</li><li>Write per-account, not per-ring, when the action is per-account. A ban list without a reason column is not evidence.</li><li>Know what our Terms of Use actually entitle us to do, and flag when the evidence supports the finding but not the action.</li></ul>Quantification &amp; reporting<ul><li>Own the abuse loss number: what it cost, on what basis, net of the revenue we reversed and the legitimate customers we caught by mistake. Same definition every month, written down.</li><li>Distinguish COGS burned, revenue at risk, revenue reversed and cash refunded — they are four different numbers and people will conflate them.</li><li>Build the recurring reporting that tells us whether the problem is growing, and the ad-hoc answer to "why did compute spike last Tuesday" that is due the same day.</li></ul>Monitoring &amp; adaptation<ul><li>Watch the detectors themselves. A rule that stops firing is a detection event, not a quiet week.</li><li>Check the instrument before explaining the movement: a missing upstream table, a silently dropped join, a vendor signal that went away. This has bitten us and it will again.</li><li>Spot new abuse patterns before they are in anybody's model — usually in a cost anomaly, a strange cohort, or a support ticket that does not fit.</li></ul>How we work<ul><li>SQL and Python on raw payment, usage and identity data in BigQuery, without anyone preparing it for you. We use AI heavily — resourcefulness beats syntax.</li><li>Close partnership with the Antifraud data scientist (you validate what they build), Payments (chargebacks and processor signals), Support (the humans who meet your false positives) and Finance (the loss number goes in the accounts).</li></ul><h2>Who We're Looking For</h2><ul><li>2+ years doing investigative or risk analytics — fraud, abuse, trust and safety, AML, chargebacks, gaming or marketplace integrity. What matters is that you have chased real bad actors, not modelled them in the abstract.</li><li>Strong SQL, without help. Self-joins, window functions, cohort replay, and joining payments to usage to identity across messy keys. This is the single most-used skill in the role.</li><li>Python at working level for analysis — pandas, notebooks, a bit of graph work.</li><li>Investigative instinct: you follow the thread, you notice the thing that does not fit, and you can say when a pattern is a coincidence.</li><li>Evidentiary discipline: you can write up a finding so that somebody who distrusts you can check it, and you know the difference between "this looks like abuse" and "this is provable."</li><li>Unit-economics literacy: gross margin per account, what compute costs, and why a negative-margin customer may be entirely legitimate.</li><li>The judgment to escalate rather than act when the evidence is thin, and to say so in writing.</li><li>Clear written and spoken English, B2+.</li></ul>Backgrounds that often do well:<ul><li>Fraud / risk analysts from fintech, payments, marketplaces, gaming, crypto or betting</li><li>Trust &amp; safety investigators and platform-integrity analysts</li><li>Chargeback, dispute or AML analysts who write their own queries</li><li>Strong product or BI analysts who got handed the abuse problem and kept it</li></ul><h2>What This Role Is Not</h2>This role is not a fit if you:<ul><li>Want to build models full time — that is the Antifraud data scientist, and it is open</li><li>Want to do content moderation or NSFW classification</li><li>Would put an account on a ban list without being able to say why in one sentence</li><li>Treat every negative-margin account as an abuser</li><li>Need a labelled dataset or a clean table before you can start</li><li>Are uncomfortable that your work gets real people's accounts restricted, sometimes wrongly</li><li>Want predictable 9–5 workdays</li></ul><h2>Hiring Process</h2><ul><li>First interview (30 min)</li><li>Business case (60 min)</li><li>Take-home with real-shaped data (7 days, ~10–12 hours of work)</li><li>Team interview (60 min)</li><li>Paid on-site trial (1 month)</li></ul><h2>The Deal</h2><ul><li>Competitive salary in USD</li><li>Equity: participation in the company's stock option program</li><li>On-site role in Almaty, Kazakhstan</li><li>Relocation support (flight + temporary housing)</li><li>Flat structure, high autonomy, fast career growth</li></ul>

Data Analyst, Antifraud

<h2>Why work at Higgsfield AI?</h2>Higgsfield AI is the fastest-scaling generative AI company in history, hitting $1B in annual revenue run rate, 30M+ users worldwide, 6M+ generations per day, and powering 390 of Fortune 500 brands.We're building at the absolute frontier of AI-powered video creation and next-generation creative tools. Joining Higgsfield means becoming part of a high-impact team shaping the future of AI-native experiences, at a company that isn't just moving fast, but rewriting what fast looks like.<h2>What This Role Means at Higgsfield</h2>Generative video has a problem most subscription businesses don't: every unit we sell costs us real compute. A stolen password costs a streaming service nothing. An account farm on an unlimited generation plan costs us GPU-seconds, at scale, every hour it runs.We have found organised operators running hundreds of accounts on a single card, reselling unlimited generations, and harvesting per-account promotional grants at industrial scale. We have also found that most of our negative-margin accounts are not abuse at all — they are ordinary heavy users on an unlimited plan, which is a pricing problem wearing a fraud costume. Telling those two populations apart, at account level, before the money is gone, is this job.You own the question of who is taking value they did not pay for, and the system that stops them.You make sure:<ul><li>We catch abuse before the compute is burned, not in a post-mortem that reconciles the loss</li><li>Every enforcement action has a measured precision, a measured cost of being wrong, and a way back for the customer we got wrong</li><li>The difference between fraud and unprofitable pricing is a number we can defend, not a vibe</li><li>When operators adapt — and they will, within days — we find out from a monitor, not from the monthly margin review</li></ul><h2>What You Will Do</h2>Detection &amp; scoring<ul><li>Own the account-abuse scoring system end to end: signals, weights, thresholds, the scoring job, the monitoring, and the recalibration when it decays.</li><li>Build detection that fires early. A rule that catches 88% of the money on day 11 is worth far less than one that catches 60% at checkout, and you should be able to say why in dollars.</li><li>Work the two halves that actually matter together: linkage (who is connected to whom) and economics (what are they consuming). Either one alone produces a system nobody can switch on — linkage without economics flags families sharing a card, economics without linkage flags our best customers.</li><li>Treat cost as a gate, not a label. On an unlimited plan, being gross-margin negative is normal.</li></ul>Entity resolution &amp; ring detection<ul><li>Find rings, not just accounts: shared payment instruments, IP and ASN concentration, email-stem families, synchronised registration bursts, behavioural fingerprints, automation signatures.</li><li>Do it without a reliable device fingerprint — we do not have one today, and part of this job is telling us what it would be worth and what it would cost.</li><li>Know where graph methods break. Transitive closure through a shared card will happily merge thousands of unrelated people into one "ring"; we have done exactly that and thrown the result away.</li></ul>Enforcement, policy &amp; the cost of being wrong<ul><li>Design graduated, reversible actions — throttle, rate-limit, step-up verification, hold, pre-grant refusal, manual review queue, ban — and match the severity to the confidence.</li><li>Own the false-positive budget explicitly: how many paying customers are we willing to inconvenience to save a dollar of compute, and what is the appeal path for the ones we get wrong.</li><li>Build the pre-grant gates. The cheapest abuse to stop is the kind we decline to enable in the first place — a trial we do not grant costs nothing to claw back.</li><li>Partner with Payments on Stripe Radar, chargebacks and dispute economics; with Support on the queue your model creates; with Legal on what our Terms actually entitle us to do.</li></ul>Measurement &amp; adversarial monitoring<ul><li>Quantify what the system is worth in money — COGS avoided, net of the revenue you destroyed and the support cost you created. Keep that number current.</li><li>Run holdouts even on enforcement, wherever it is legal and safe to do so, because otherwise you will never know what your rules are worth.</li><li>Monitor for adaptation, not just drift. Model decay here is caused by an adversary, and it looks different: a signal stops firing, a ring changes shape, a cohort's behaviour shifts inside a week.</li><li>Watch your own inputs. A detection system that silently loses a feature degrades to a system that cannot reach its own threshold — and reports nothing wrong while doing it.</li></ul>Making it usable<ul><li>Ship scores and reasons, never scores alone. An analyst, a support agent or an auditor must be able to read why an account was actioned.</li><li>Produce evidence that survives outside the company. Our abuse work has already been used in an external audit and in Terms-of-Use enforcement; write for that standard.</li><li>Work in SQL, Python and BigQuery on raw event, payment and generation data. We use AI heavily — resourcefulness beats syntax.</li></ul><h2>Who We're Looking For</h2><ul><li>Experience building abuse, fraud or trust-and-safety detection that actually took action on real users — payments fraud, promo abuse, multi-accounting, bonus abuse, account takeover, marketplace or gaming abuse. Anti-money-laundering and credit-risk backgrounds transfer if the modelling was yours.</li><li>Genuine understanding of the adversarial setting: that your counterparty responds, that your training labels are generated by your own past decisions, and that offline AUC on a censored label set is close to meaningless.</li><li>Strong SQL and Python on raw event data without help: joins across payments, usage and identity, window functions, cohort replay. Gradient boosting, and the judgment to know when a two-condition rule beats a model.</li><li>Comfort with graph and linkage thinking — connected components, shared-attribute clustering, and an instinct for when a link is evidence and when it is coincidence.</li><li>Precision-first evaluation instincts: precision at the operating point, cost-weighted error, and why you would take 20% recall at 90% precision over the reverse in an enforcement system.</li><li>Unit-economics literacy: gross margin per account, what compute actually costs us, why a negative-margin customer may be entirely legitimate.</li><li>The judgment to escalate rather than act when the evidence is thin, and to say so in writing.</li><li>Clear written and spoken English, B2+.</li></ul>Backgrounds that often do well:<ul><li>Fraud / risk data scientists from fintech, payments, marketplaces, gaming or crypto</li><li>Trust &amp; safety and platform-integrity teams who owned detection and enforcement policy</li><li>Growth or product data scientists who ended up owning promo-abuse because nobody else would</li><li>Analysts from payment processors, PSPs or chargeback/dispute operations who moved into modelling</li></ul><h2>What This Role Is Not</h2>This role is not a fit if you:<ul><li>Want to build content-moderation or NSFW classification — that is a different function here</li><li>Would ship a ban list without knowing its precision</li><li>Optimize AUC on a label set your own enforcement created, and call it validated</li><li>Need a labelled fraud dataset to exist before you can start</li><li>Treat every negative-margin account as an abuser</li><li>Are uncomfortable that being right 90% of the time means being wrong about real, paying, legitimate people — and that you own what happens to them</li><li>Want predictable 9–5 workdays</li></ul><h2>Hiring Process</h2>We move fast:<ul><li>Screening call (30 min)</li><li>Hiring-manager screen (30 min)</li><li>Business case (1 hour)</li><li>Practical home task (7 days)</li><li>Team interview (60 min)</li><li>Paid on-site trial (1 month)</li></ul><h2>The Deal</h2><ul><li>Competitive salary in USD</li><li>Equity: participation in the company's stock option program</li><li>On-site role in Almaty, Kazakhstan</li><li>Relocation support (flight + temporary housing)</li><li>Flat structure, high autonomy, fast career growth</li></ul>

Data Scientist, Antifraud

<h2>Why work at Higgsfield AI?</h2>Higgsfield AI is the fastest-scaling generative AI company in history, hitting $1B in annual revenue run rate, 30M+ users worldwide, 6M+ generations per day, and powering 390 of Fortune 500 brands.We're building at the absolute frontier of AI-powered video creation and next-generation creative tools. Joining Higgsfield means becoming part of a high-impact team shaping the future of AI-native experiences, at a company that isn't just moving fast, but rewriting what fast looks like.<h2>What This Role Means at Higgsfield</h2>We sell subscriptions and credit packs to consumers in over a hundred countries, and today almost all of it moves as cross-border card payments in USD. That has three consequences, and this role owns all three.We are declined more than we should be. In some of our largest growth markets roughly one attempt in three fails, and a meaningful share of those are not "no money" — they are cross-border blocks, card limits, stale credentials on renewal, and issuers who do not recognise us.We pay more than we should. Our blended cost of acceptance is the single largest line below compute, and the majority of the network component sits on transactions our processor classes as cross-border.We are not on the rails our customers use. In two of our fastest-growing markets, the dominant local payment method is one we do not offer at all.You own the measurement and the argument behind fixing all of it.You make sure:<ul><li>We know our true authorization rate — at the unit the business actually cares about, not the one that is easy to compute</li><li>Every basis point of payment cost has a name, a geography and an owner</li><li>A decline is a diagnosis, not a statistic</li><li>When we propose a new rail, a new entity or a new processor arrangement, the number underneath it holds up to Stripe's own analysis and to our board's</li></ul><h2>What You Will Do</h2>Authorization &amp; decline analysis<ul><li>Own authorization rate end to end: by country, issuer, BIN, card brand and funding type, plan price point, first payment vs renewal, and payment method.</li><li>Build and maintain the decline taxonomy — what each decline code actually means, which are recoverable, which are terminal, and which are us rather than them.</li><li>Measure at the right unit. An invoice that succeeds on the third retry is a success, not two failures and a success, and reporting it the other way has made teams optimise the wrong thing.</li><li>Separate soft declines we can recover from hard declines we cannot, and put a number on the recoverable pool.</li></ul>Cost of acceptance<ul><li>Own the blended take rate and its decomposition: interchange, scheme fees, processor markup, cross-border and currency-conversion components, disputes, and the fixed per-transaction pieces.</li><li>Find where the cost actually sits. Averages hide it — the cost is concentrated by corridor, by card type and by whether the transaction is domestic.</li><li>Build the evidence for commercial conversations with our processor, and keep it current enough to reuse.</li></ul>Local payment methods, entities and routing<ul><li>Size the case for new rails market by market: what share of local commerce runs on them, what our current card performance costs us, and what we would realistically recover.</li><li>Model merchant-of-record and local-acquiring arrangements against the alternative of our own entities, honestly — including the fee we would pay for the privilege.</li><li>Design and read the experiments that prove it, with the product analytics team. A new payment method is an A/B test, not a launch.</li></ul>Renewals, dunning and involuntary churn<ul><li>Own the retry and dunning strategy as a measurable system: when to retry, how often, through which rail, and when to stop.</li><li>Quantify involuntary churn separately from voluntary. They look identical in a cancellation count and they need completely different fixes.</li><li>Track the health of stored credentials — network tokens, card-account-updater coverage, expiring cards — because in a subscription business that is silent revenue leakage.</li></ul>Disputes, refunds and reconciliation<ul><li>Own dispute and chargeback rates against network thresholds, with the lag handled properly — disputes arrive weeks after the charge and a same-period denominator understates you.</li><li>Reconcile processor data to the revenue ledger and explain the differences rather than plugging them.</li><li>Work with the antifraud team where disputes are abuse rather than genuine dissatisfaction.</li></ul><h2>How we work</h2><ul><li>SQL and Python on raw processor and billing data in BigQuery. We use AI heavily — resourcefulness beats syntax.</li><li>Partner with Finance (the numbers get booked), Product (checkout and paywall), Engineering (the billing integration) and our processor's team directly.</li></ul><h2>Who We're Looking For</h2><ul><li>2+ years in payments analytics, payment operations, billing, or risk at a merchant, PSP, acquirer, or fintech. This is a domain role — general analytics experience without payments does not transfer quickly enough.</li><li>Fluency in the actual mechanics: authorization vs capture vs settlement, decline codes, 3DS and SCA, network tokens and account updater, interchange and scheme fees, chargeback lifecycle, MCC, BIN, cross-border and DCC.</li><li>Strong SQL, without help. Most of this job is joining sessions to intents to charges to invoices to refunds across imperfect keys and getting the denominator right.</li><li>Python at working level for analysis.</li><li>The instinct to check the unit of measurement before quoting a rate — per attempt, per invoice, per user, per session are four different numbers and only one of them answers the question.</li><li>Comfort with subscription billing specifically: renewals, proration, plan changes, failed payments, dunning, involuntary churn.</li><li>Commercial judgment: you can build the case for a rail or a rate and defend it against a vendor who does this for a living.</li><li>Clear written and spoken English, B2+.</li></ul>Backgrounds that often do well:<ul><li>Payment operations or payments analytics at a consumer subscription, marketplace or gaming company</li><li>Analysts from PSPs, acquirers, orchestration platforms or card networks</li><li>Billing / revenue operations analysts who owned dunning and involuntary churn</li><li>Risk or chargeback analysts who moved toward the acceptance side</li></ul><h2>What This Role Is Not</h2>This role is not a fit if you:<ul><li>Want to own checkout UX or pricing — that is Product Analyst, and it is open</li><li>Want to build fraud models — that is the Antifraud data scientist, and it is open</li><li>Would report an authorization rate without saying what the denominator was</li><li>Would take a processor's own analysis of their own performance at face value</li><li>Need someone else to prepare the data</li><li>Want predictable 9–5 workdays</li></ul><h2>Hiring Process</h2><ul><li>First interview (30 min)</li><li>Business case (60 min)</li><li>Take-home with real-shaped data (7 days, ~10–12 hours of work)</li><li>Team interview (60 min)</li><li>Paid on-site trial (1 month)</li></ul><h2>The Deal</h2><ul><li>Competitive salary in USD</li><li>Equity: participation in the company's stock option program</li><li>On-site role in Almaty, Kazakhstan</li><li>Relocation support (flight + temporary housing)</li><li>Flat structure, high autonomy, fast career growth</li></ul>

Higgsfield

Open jobs at Higgsfield

Security Engineer, ML Infrastructure

Backend Software Engineer, Agentic

Data Analyst, Antifraud

Data Scientist, Antifraud

Payments Analyst

Working for Higgsfield?

Featured companies