Senior Security Engineer (Product Security)

Matchbox; Sydney; Hybrid; AUD 150,000 - 210,000; Full time

Job summary

Immutable is seeking a Senior Security Engineer (Product Security) to join our hybrid Sydney team. You will own vulnerabilities, model threats, and work with product engineers to fix issues before they reach production.

The role blends hands-on security, prototyping AI tooling, and cloud security across AWS/GCP, with a focus on Web3 and smart contracts in a fast-growing gaming platform. Based in Sydney, you will partner with engineers and security colleagues to build secure systems, maintain

Qualifications

• Application security depth and ability to fix issues in code.

Responsibilities

• Own the vulnerability management program and triage issues.
• Develop threat models and maintain attack graphs as product changes.
• Review security of new services and code shipped by product engineers.
• Collaborate with Security, Product and Engineering teams to reduce risk.

Skills

Vulnerability management

Threat modeling

Security reviews

AWS security

GCP security

Web3 security

AI tooling

Software engineering

Tools

Bug bounty platforms

Security tooling

Job description

# Senior Security Engineer (Product Security)ImmutableHybrid • SydneyFull Time Permanent## Role OverviewAbout Us Immutable is the world's fastest-growing game platform, built to power the next generation of games. Immutable's full-stack product suite powers every stage of game creation and growth from infrastructure to player engagement.Founded in 2018, we're one of the fastest Australian companies to reach unicorn status, raising more than AUD $400M+ at a valuation of AUD $3.5B. Today more than 700 games build on Immutable, and industry leaders like Ubisoft have chosen us as their partner for the future of gaming. Immutable Audience, our newest product line, is the fastest-growing SaaS in our history.We're growing faster than we ever have, and we're hiring the talent who'll take it further About The Role Immutable builds products for game studios. One side of the business is a marketing data platform that helps studios find and keep players. The other is blockchain infrastructure, including our own Ethereum layer-2 network and Passport, a wallet players use to hold real digital assets. For a security engineer, this means a wide spread of work across web apps and APIs, AWS and GCP, and smart contracts where a bug has a dollar value attached.You’ll join a security team of five and report to our Head of Security. Most of your time will be spent with the product engineering teams, reviewing new services, building threat models with them and fixing issues in their code. Our target is to fix 80% of vulnerabilities before they reach production, and this role is central to hitting it.You'll Be Empowered To * Own, our vulnerability management program, including the Bugcrowd and Immunefi bug bounties and findings from our scanning tools, with a goal of 90%+ SLA compliance on critical and high issues* Own the AI agents that review pull requests for security issues and triage incoming bugs* A security context layer (threat models, asset inventory, past findings) that lets those agents triage and propose fixes with less human input* Keeping our threat models and attack graphs current as the product changesWe'd Love You To Bring * Application security depth. You can find a broken auth flow or an injection bug in code, explain why it happened and fix it properly. You’re also a capable software engineer who ships production code, whether that’s a fix in someone else’s service or a tool you built from scratch.* You’ve built AI tooling yourself. It might be an agent, an automation or an internal tool, and you can tell us what worked, what didn’t and how you knew. Plenty of people use AI tools well. For this role we need someone who builds them.* Solid AWS security experience will help a lot (IAM, network controls, secrets, misconfigurations). GCP, detection and response experience, and web3 knowledge are all useful, though none are deal-breakers. Side projects and open source work tell us a lot, so please include them.* You’ll enjoy this if you like autonomy, work well beside engineers and are happy to help out in other parts of security when a small team needs it. It’s probably not a fit if you’d rather report findings than fix them.Bonus Points For * Web3 experience, such as wallet, smart contract or dApp security. You can learn it here, but it’ll help from day one.* Deeper detection and response experience, or a real interest in growing into it* Experience running a bug bounty program or findings pipeline end to end