Senior Security Engineer, Anti-Abuse (f/m/x)

Exmox GmbH; Hamburg; Hybrid; EUR 90,000 - 130,000; Full time

Benefits offered by this job

Transport subsidy

Learning budget

Wellness and gym

Workation

Bi-weekly team lunches

Job summary

Exmox GmbH in Hamburg seeks a Senior Security Engineer, Anti-Abuse to own security end-to-end in a cloud-native AWS environment. You will design and incubate defenses for a payout ecosystem, addressing cross-cutting abuse and AI-assisted threats.

You’ll work within the Platform Engineering team on design, testing, and incident response for high-traffic systems and complex security challenges.

Qualifications

• Engineering background with code reading in Python/TypeScript (Go a plus).
• Deep application security knowledge: authentication, session design, authorization and trust boundaries.
• Experience with adversarial traffic, bot mitigation, and fraud pressure at scale.
• Experience in AWS WAF tuning, detection engineering, and incident response.
• Proficiency with Terraform and Kubernetes controls in a platform design context.
• Strong communication: write design docs, explain risks to leadership.

Responsibilities

• Secure design and code review across GraphQL, Python and Go services; perform threat modelling with product teams.
• Hands-on testing of auth, session, and payout flows before release and external tests.
• Defend against bots, credential stuffing, account takeover, multi-accounting, and payout fraud.

Skills

Python

TypeScript

Go

Adversarial traffic

Threat modelling

Secure design

Cloud security

Tools

AWS WAF

Kubernetes

Terraform

GraphQL

Datadog

Job description

Your Mission

This is a company built for growth.

When you join exmox, you're stepping onto a global, highly competitive playing field, solving real problems in environments that push you beyond your comfort zone. We move fast, cut the noise, and focus on what actually matters, because in our industry, speed wins.

With 50M+ platform downloads, we’re rapidly scaling one of the most exciting innovations in mobile gaming: a rewarded user engagement and acquisition platform that helps players discover, and engage with games they enjoy - creating lasting value for both players and gaming studios.

exmox pays out real money to real users, and that shapes our security posture. AsSenior Security Engineer, Anti-Abuse (f/m/x), you'll be the first dedicated security hire, sitting inside the Platform Engineering team and owning the security vertical end to end in a cloud-native AWS environment running at scale. This isn't an advisory or reactive role: you'll design, prototype and incubate the defences that protect our payout ecosystem against cross-cutting abuse, and define how we handle a threat surface that AI is widening on both sides: cheap adaptive attack tooling, and the trust model around the AI coding agents in our own development workflow.

If you're excited by complex systems, high traffic, data-driven decisions, and the chance to grow by solving challenging problems, we want to hear from you.

What You’ll Own:

• Application security:Secure design and code review across GraphQL, Python and Go services, finding logic flaws, broken trust boundaries, and authorization gaps, plus threat modelling with product teams during refinement, not after.

• Offensive testing:Hands-on testing of our own auth, session, and payout flows, before a release and before an external test, not only after.

• Abuse and fraud prevention:Defend against bots, credential stuffing, account takeover, multi-accounting, and payout fraud, working alongside our fraud team on per-account controls, step-up verification, and device and session signals.

• Edge defense:Own AWS WAF end to end, from managed and custom rule groups, rate-based rules and bot mitigation to the tuning loop that goes with it, plus CloudFront, origin protection, and DDoS posture as we move to a multi-region edge.

• Detection and response:Turn our full WAF logging and strong Datadog coverage into security detections that actually fire, and lead security incidents through technical response, postmortem, and follow-ups.

• Security in the SDLC and cloud:Build CI gates developers don't route around (secret detection, dependency and container scanning, SBOM), ship secure defaults in shared Helm and Terraform modules, and implement cloud and Kubernetes controls as code.

• Compliance and assurance:Coordinate external penetration testing and drive remediation, and own ISO 27001 readiness and GDPR-adjacent engineering as an engineering problem: mapping controls to what we already do and automating the evidence.

What You Bring

• Engineering background:You write code, ideally Python and TypeScript (Go is a plus), and can read an unfamiliar service and find the logic flaw no scanner will catch.

• Application security depth:You know authentication and session design, authorization and trust boundaries, API and GraphQL security, injection classes, and secrets handling. You've fixed these bugs, not just filed them, and you validate a control by trying to break it yourself.

• Adversarial traffic:You have real experience with bot mitigation, credential stuffing, account takeover, rate limiting at scale, or fraud pressure, in any domain where someone is actively working against you. You think about where an attack actually pays off and design controls that make it not worth running.

• AWS WAF and detection engineering:You've written and tuned custom WAF rules, handled false positives against real users, and can go from raw logs to a working alert using SQL/Athena or equivalent and Datadog or comparable tooling.

• AWS and Kubernetes:You're fluent enough to implement controls yourself in Terraform and be credible in a Platform design review.

• Influence and ownership:You can write a design doc developers read, disagree without it becoming a standoff, and explain risk to leadership in terms of money. You've handled incidents with real customer impact, and you're comfortable being the only security person, sequencing priorities and saying "not yet" often.

• Nice to have:ISO 27001 or SOC 2 experience as an implementer, a marketplace, fintech, gaming, or ad-tech background (mobile attribution is a bonus), policy-as-code (Kyverno, OPA), and certifications such as AWS Security Specialty, CKS, or OSCP.

Our Stack:

AWS, K8s, Terraform, GitLab CI, Python (FastAPI), Go, TypeScript, Apollo Federation GraphQL, Nuxt, Flutter, Datadog, biometric liveness verification, Databricks.

How We Win

• Speed is the feature.Speed beats rocket science. We move fast, test fast, and multiply our pace with AI, because action creates information and small wins compound. A fast failure is a lesson we learn from, a slow one is a problem we can't afford.

• Focus on the essential.Done is better than perfect. We stay focused on what actually moves us forward and protect people's time from anything that doesn't. We're direct in how we communicate too, no rambling, no unnecessary detail.

• See it. Own it. Solve it.The first to see it is best placed to fix it. We're not a place for comfort, we're a place for doers. "Not my job" isn't in our vocabulary, if you spot something, you help make sure it gets solved.

• Respect others.Trust multiplies. Respect is non-negotiable. We disagree with ideas, never with people. Trust here is built the same way it is anywhere, through consistency, a thank you, a moment of listening, and owning your mistakes.

• Perks that help you focus on what matters.Transport subsidy, learning budget, wellness and gym, workation, bi-weekly team lunches, and more. The perks are great, but the real reason people join and stay is the challenge, the ownership, and the drive to win together.

Please note: this is not a remote only position, we offer you a flexible hybrid model here in Hamburg, Germany - working from home on Mondays & Fridays, coming to the office on Tuesday, Wednesday & Thursday!