Senior Product Security Engineer
New
B
BetbySportsbook security
Workable locations: Serbia. Georgia. Poland. Spain. LatviaFull-TimeSenior
Salary not disclosed
Apply NowOpens the employer's application page
Job Details
- Languages
- English at an upper-intermediate level or higher.
- Experience
- At least 5 years of experience in product security, application security or security architecture, including at least 3 years of hands-on threat modelling and/or security design review.
- Required Skills
- Kubernetes
Requirements
- Have at least 5 years of experience in product security, application security or security architecture, including at least 3 years of hands-on threat modelling and/or security design review.
- Have experience facilitating threat modelling using STRIDE, PASTA, attack trees or similar methods, and working with data flow diagrams, trust boundaries and attack surface analysis.
- Have experience making security go/no-go decisions on releases and designs, justifying blocking decisions with concrete risk and proposing workable alternatives or compensating controls.
- Understand secure architecture for distributed systems, including microservices, API gateways, reverse proxies, CDN and caching layers, message queues and multi-tenant isolation patterns.
- Have practical knowledge of JWT/JWS validation, OAuth2/OIDC, mTLS, HMAC, asymmetric request signing, key management and rotation, replay protection and idempotency.
- Be able to turn threats into concrete, testable security requirements and acceptance criteria for developers, AppSec and QA.
- Understand business logic and abuse risks in transactional systems, including race conditions, double processing, parameter and state tampering, precision and rounding issues, and tenant authorization boundaries.
- Have experience assessing third-party vendors, SaaS products and API integrations, including architecture, data flows, authentication, encryption, logging and resilience; critically review SOC 2, ISO 27001 and penetration-test summaries.
- Understand cloud and edge security architecture, including AWS CloudFront, WAF, Shield or equivalents, Kubernetes-based deployments, and application-level resilience against DoS and resource exhaustion.
- Be able to produce clear, concise threat models, design review conclusions and risk statements that engineers and leadership can act on.
- Have strong stakeholder management and negotiation skills to agree security requirements with engineering, product and business teams without formal authority.
- Have English proficiency at upper-intermediate level or higher.
Responsibilities
- Own the security review process from intake to sign-off, including risk-based triage and review triggers for high-risk changes.
- Embed security reviews into product delivery and report on review coverage and flow metrics.
- Approve in-scope changes and block releases when residual risk is unacceptable; document exceptions and risk acceptance decisions.
- Facilitate threat modelling for features, services, integrations and architectural changes, and maintain threat models for critical platform flows.
- Review technical designs, API contracts and integrations; develop security requirements and acceptance criteria.
- Develop secure architecture patterns, target-state designs and compensating controls for legacy constraints.
- Maintain security capabilities, map them against threat models and drive closure of identified gaps.
- Perform technical security assessments of vendors, providers and integrations, and support the technical security side of operator onboarding.
- Document risks and track them to remediation or formal acceptance in coordination with GRC.
- Contribute design-level root cause analysis and preventive controls to post-incident reviews, and report on product security posture, release decisions and open risks.
View Full Description & ApplyYou'll be redirected to the employer's site
