BETBY

Senior Product Security Engineer

Brak informacji o wynagrodzeniu

SeniorZdalnieFull-time

#474988·Dodano 9 dni temu·2

Źródło: BETBY

Aplikuj teraz

Tech Stack / Keywords

STRIDEPASTAJWT/JWSOAuth2/OIDCmTLSAWS CloudFrontKubernetesOWASP ASVSMITRE ATT&CKPython

Podsumowanie oferty

Join the Application Security & Incident Response team as the security design authority for external and internal products and related business systems. You will own the security review and release-approval process, facilitate threat modelling, and define secure architecture and security requirements.

Wymagania

At least 5 years of experience in product security, application security, or security architecture, including at least 3 years of hands-on threat modelling and/or security design review.
Experience facilitating threat modelling sessions using STRIDE, PASTA, attack trees, or similar approaches, and selecting the appropriate depth based on risk. Confidence with data flow diagrams, trust boundaries, and attack surface analysis.
Experience making security go/no-go decisions on releases and designs, justifying blocking decisions with concrete risk, proposing workable alternatives or compensating controls, and reaching agreement with business stakeholders.
Strong understanding of secure architecture for distributed systems, including microservices, API gateways, reverse proxies, CDN/caching layers, message queues, and multi-tenant isolation patterns.
Practical knowledge of authentication, authorisation, and integrity mechanisms: JWT/JWS validation, OAuth2/OIDC, mTLS, HMAC, asymmetric request signing, key management and rotation, replay protection, and idempotency.
Ability to turn threats into concrete, testable security requirements and acceptance criteria that developers can implement and AppSec/QA can verify.
Understanding of business logic and abuse risks in transactional systems, including race conditions, double processing, parameter and state tampering, precision/rounding issues, and authorisation boundaries between tenants.
Experience assessing the technical security of third-party vendors, SaaS products, and API integrations, including architecture, data flows, authentication, encryption, logging, and resilience. Ability to critically review assurance materials such as SOC 2, ISO 27001, and penetration-test summaries from a technical perspective.
Understanding of cloud and edge security architecture (AWS CloudFront, WAF, Shield, or equivalents), Kubernetes-based deployments, and application-level resilience against DoS and resource exhaustion.
Ability to produce clear, concise threat models, design review conclusions, and risk statements with residual risk that engineers and leadership can act on.
Strong stakeholder management and negotiation skills, including agreeing security requirements with engineering, product, and business teams without formal authority or escalation to senior leadership.
English at upper-intermediate level or higher.

Nice to have:

Background in application security testing, penetration testing, or software development that informs realistic threat assessment.
Certifications such as CSSLP, OSWE, CCSP, AWS Certified Security – Specialty, CISSP-ISSAP, or equivalent.
Experience in betting/gambling, payments, or fintech, and awareness of industry-specific regulatory technical requirements.
Experience with threat modelling tools or threat-modelling-as-code, such as OWASP Threat Dragon, IriusRisk, Threagile, or Microsoft Threat Modeling Tool.
Familiarity with OWASP ASVS, OWASP SAMM, NIST SSDF, MITRE ATT&CK, and CAPEC as sources of requirements and threat libraries.
Experience with post-incident analysis and identifying root causes at the design level.
Experience assessing the security of enterprise and SaaS integrations, such as ERP, collaboration suites, and customer support platforms with custom authentication.
Scripting skills, for example Python, to automate review workflows, Jira reporting, or architecture checks.

Obowiązki

Security review flow

Own the security review process from intake to sign-off, including risk-based triage and review triggers for high-risk changes.
Embed security review into product delivery and report on review coverage and flow metrics.

Security release authority

Approve in-scope changes and block releases when residual risk is unacceptable, escalating immediately when required.
Weigh security risk against business needs, propose workable alternatives, and document exceptions and risk acceptance decisions.

Threat modelling

Facilitate threat modelling for features, services, integrations, and architectural changes.
Maintain threat models for critical platform flows and a reusable threat library.

Security design review and secure architecture

Review technical designs, API contracts, and integrations; develop security requirements and acceptance criteria.
Develop secure architecture patterns and define target-state designs and compensating controls for legacy constraints.

Security capability management

Maintain security capabilities, map them against threat models, and drive closure of identified gaps.

Third-party technical security

Assess the technical security of vendors, providers, and integrations, and define technical security requirements for them.
Support the technical security aspects of operator onboarding and integration.

Risk and GRC alignment

Document identified risks and track them to remediation or formal acceptance in coordination with GRC.

Post-incident analysis

Contribute design-level root cause analysis and preventive controls to post-incident reviews.

Enablement and reporting

Support technical leads in owning threat mitigation for their solutions and provide self-service guidance for low-risk changes.
Report on product security posture, release decisions, and open risks.

Benefity

Comprehensive health insurance coverage.
Up to 10 days of paid sick leave without a medical certificate.
20 days of paid vacation, plus additional leave for important life events.
Learning and growth opportunities with support for professional development.
Language learning support.
Modern hardware provided for work.
Corporate events and team activities.
Welfare support program for critical situations.
Gifts and support for major life milestones.

Ubezpieczenie

Płatne święta

Kursy językowe

Spotkania integracyjne

BETBY

4 aktywne oferty

Zobacz wszystkie oferty

Aplikuj teraz