Lead Application Security

Fanatics Momentum; Abu Dhabi; On-site; AED 420,000 - 720,000; Full time

Job summary

Fanatics Momentum in the UAE is seeking a Lead, Application Security to own testing and DevSecOps across its growing platform. You will drive extensive security testing across SAST, DAST, IAST, SCA and secure coding practices, while managing platform lifecycle and tuning rules for accuracy.

The role requires 8+ years in software/cybersecurity with hands-on AppSec delivery and strong CI/CD integration. This is a fast-paced, regulated gaming environment with opportunities to shape AI-enabled

Qualifications

• 8+ years in software engineering, DevOps, or cybersecurity.
• 4+ years delivering application security in enterprise environments.
• Experience owning and operating enterprise app security platforms.
• Strong CI/CD integration with GitHub Actions, GitLab CI or Azure DevOps.
• Production coding experience in Python, Go, Java/Kotlin, C# or TS.
• Knowledge of OWASP Top 10 and OWASP API Security Top 10.

Responsibilities

• Own application security testing across SAST, DAST, IAST, SCA.
• Manage lifecycle of security platforms, including upgrades.
• Tune rulesets and reduce false positives.
• Provide remediation guidance to developers.
• Embed security evidence into CI/CD pipelines.
• Lead security champions network.

Skills

8+ years exp

AppSec delivery

CI/CD integration

Tools

AppScan / Checkmarx / Veracode

Snyk

GitHub Advanced Security

Python

Go

Java/Kotlin

C#

TypeScript

Job description

Job Description:

About Fanatics Momentum

Fanatics Momentum is building the UAE's leading regulated commercial gaming operator. Licensed by the General Commercial Gaming Regulatory Authority (GCGRA), we operate across lottery, iGaming, sportsbook, and digital content, combining Momentum's regional foundation with Fanatics' global product, technology, and scale. The business is ambitious, well-resourced, and moving fast. If you want to help build a category-defining operator in one of the world's most exciting regulated gaming markets, this is the right time to join.

Overview

We're building a new UAE-based business spanning Sportsbook, Casino, Lottery and a broader connected Fan Ecosystem, backed by Fanatics and Momentum. As Lead, Application Security, you'll own application security testing and DevSecOps engineering end to end across FanMo's technology platforms.

Responsibilities

What You’ll Own

Application Security & Testing

• Own FanMo's application security testing capability across SAST, DAST, IAST, SCA, secrets detection, container scanning, infrastructure-as-code scanning, API security and mobile application testing.
• Manage the full lifecycle of application security platforms, including evaluation, implementation, integration, configuration, upgrades and ongoing optimization.
• Establish application onboarding, scanning policies, security rules and testing frequency based on application risk.
• Tune existing rulesets and develop custom rules to improve accuracy and reduce false positives.
• Build a consolidated view of application security risk, prioritizing findings based on exploitability and business impact.
• Extend application security testing to AI-generated code and AI-enabled product features.

Vulnerability Management & Developer Enablement

• Own vulnerability triage, validation, prioritization and remediation tracking across application security findings.
• Establish automated workflows to route findings to engineering teams, track remediation against agreed SLAs and verify closure.
• Build developer self-service capabilities, including IDE integrations, secure templates, approved base images and hardened libraries.
• Provide practical, actionable remediation guidance directly to developers.
• Establish and support a security champions network across engineering teams.
• Develop secure-by-default instructions, reusable rules and skills for AI coding assistants to ensure generated code aligns with organizational security standards.
• Deliver targeted secure-coding education based on recurring vulnerabilities and root-cause analysis.

Offensive-Informed Application Security

• Validate high and critical vulnerabilities through hands-on testing and proof-of-concept exploitation in non-production environments.
• Conduct manual security testing of high-risk features, APIs and business logic ahead of release.
• Translate confirmed exploits and penetration-testing findings into automated regression tests.
• Design abuse-case testing for gaming-specific risks, including bonus and promotion abuse, wallet and balance race conditions, bet manipulation, account takeover and responsible-gaming control bypasses.

Software Supply Chain Security

• Define and implement security controls for dependency management, artifact signing, provenance verification and Software Bill of Materials (SBOM) generation.
• Assess third-party libraries, components and build dependencies for security risk.
• Address AI-specific supply chain risks, including AI-suggested or non-existent packages, third-party models, MCP servers, plugins and IDE extensions.
• Monitor newly disclosed vulnerabilities in third-party components and drive prioritized remediation across affected applications.

Threat Modeling & Secure Software Delivery

• Establish repeatable threat-modeling practices for application changes, scaled according to risk.
• Translate product security requirements into practical acceptance criteria, user stories and test cases.
• Embed security evidence generation into CI/CD pipelines to support regulated platforms, releases, audits and certifications.
• Threat-model AI-enabled features and agentic workflows, including risks such as prompt injection, sensitive-data exposure and excessive agency.
• Partner with regulatory compliance and security teams to ensure application security evidence supports relevant regulatory and certification requirements.

Security Automation, AI & Continuous Improvement

• Build and maintain security automation and internal tooling where commercial solutions don't meet business requirements.
• Apply engineering best practices to security tooling, including version control, peer review, testing and documentation.
• Implement guardrails for AI-assisted software development and test LLM-enabled product features against recognized security guidance, including the OWASP Top 10 for LLM Applications.
• Leverage approved AI capabilities for vulnerability triage, code analysis and documentation, with appropriate human oversight.
• Establish performance reporting across application security, including testing coverage, pre-merge remediation rates, time to remediate, false-positive rates and automation efficiency.
• Continuously improve the effectiveness, reliability and adoption of security tooling across engineering.

Required Qualifications

• 8+ years of experience across software engineering, DevOps or cybersecurity, including at least 4 years of hands-on application security delivery.
• Proven experience owning and operating enterprise application security platforms such as HCL AppScan, Checkmarx, Veracode, Snyk, Wiz Code or GitHub Advanced Security.
• Strong hands-on experience across SAST, DAST, IAST, SCA, secrets detection and container scanning, including configuration and tuning at scale.
• Experience integrating and operating security controls within CI/CD platforms such as GitHub Actions, GitLab CI or Azure DevOps.
• Production-quality coding experience in at least one of Python, Go, Java/Kotlin, C# or TypeScript.
• Deep understanding of the OWASP Top 10 and OWASP API Security Top 10, with the ability to identify, exploit and remediate vulnerable code.
• Practical web and API security testing experience, including authentication and authorization vulnerabilities, injection, SSRF, deserialization and race conditions.
• Experience using Burp Suite or equivalent application security testing tools.
• Hands-on experience securing AI-assisted development environments, including AI coding assistants and agents.
• Working knowledge of the OWASP Top 10 for LLM Applications and risks such as prompt injection.
• Familiarity with container security, Kubernetes deployment security and infrastructure-as-code practices.
• Strong communication skills, with the ability to influence engineering teams and translate technical security risks into practical business recommendations.
• Demonstrated ability to take ownership, drive delivery and balance security requirements with engineering velocity.

Preferred Qualifications

• Experience working in regulated industries such as gaming, payments, financial services or other high-assurance environments.
• Knowledge of software supply chain security frameworks and tooling, including SLSA, Sigstore, CycloneDX or SPDX.
• Experience securing real-time, high-transaction platforms and mobile applications.
• Experience establishing or managing a security champions program.
• Familiarity with AI security and governance frameworks such as MITRE ATLAS, NIST AI RMF or ISO/IEC 42001.
• Experience building security tooling or automation using LLM APIs.
• Relevant degree or equivalent practical experience.
• Industry certifications such as OSWE, OSCP, GWAPT or CSSLP. Demonstrable bug bounty contributions, CVEs or published security research are particularly valued.

If you possess some of these qualifications but not all of them, we still encourage you to apply!

At Fanatics Momentum, we’re proud to be a fair, transparent, and inclusive employer. We value diversity, collaboration, and innovation, and we’re committed to creating an environment where every team member can thrive.

Requirements: