Senior Application Security Engineer

LeoVegas Group; Málaga; Híbrido; EUR 70.000 - 100.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Hybrid work policy

Workation benefits

Wellness contribution

Cobee – benefits app

Health insurance

Life insurance

Employee Assistance Program

Short Fridays

Snacks & drinks

Social events

Descripción de la vacante

LeoVegas Group is seeking a hands‑on Senior Application Security Engineer to become a founding member of our security team. You will secure consumer‑facing platforms and cloud infrastructure in a regulated iGaming environment, balancing compliance with the agility needed to grow.

You will embed security into the software development lifecycle, lead security testing, and guide threat modeling, wire security by design decisions, and collaborate with engineering to reduce risk while enabling

Formación

• AppSec specialist with secure‑by‑design mindset across web and mobile apps.
• Code review and auditing in modern languages with automated tools.
• Deep networking knowledge: TCP/IP, DNS, HTTP/S, TLS; secure traffic at protocol level.
• Cloud security familiarity: Kubernetes and microservices trade‑offs at scale.
• Experience in regulated industries (iGaming/Fintech/Healthcare) and rigorous compliance.
• Automation of security workflows with Python or similar.
• Ability to communicate risk to non‑technical stakeholders and balance business goals with security.
• Experience evaluating, onboarding, and managing external security vendors.

Responsabilidades

• Embed security into the software development lifecycle from design to release, partnering with engineering to enable secure defaults.
• Audit web and native applications and drive security testing and code review.
• Harden APIs and focus on authorization and abuse prevention.
• Manage and tune WAF and DDoS mitigation to ensure availability.
• Harden cloud infrastructure and secure pipelines through automation.
• Support regulatory certifications and security governance.
• Collaborate with engineering and product teams to promote a Security by Design culture.
• Engage with external vendors and managed service providers as needed.
• Collaborate with Google to shape AI workflow security frameworks.

Conocimientos

AppSec Specialist

Code Reviewer

Networking Native

Cloud‑Security

Regulated Background

Scripting Skills

Pragmatic Communicator

Provider Management

Descripción del empleo

About The Role

We are looking for a hands‑on Senior Application Security Engineer to become a founding member of our security team. You will be joining a highly regulated iGaming environment where uptime, data integrity, and user trust are paramount. You will shape the security of our consumer‑facing platforms and of the cloud infrastructure they run on, balancing compliance requirements with the agility our business needs to grow.

Responsibilities

• Secure the Development Lifecycle: Embed security into every stage of how we build software, from threat modeling at design time to security review before release. Partner with engineering to make secure‑by‑default the path of least resistance.
• Audit Web & Native Applications: Drive and run security testing and code review across our web and mobile apps.
• Protect the API Surface: Review and harden the APIs powering our platforms with focus on authorization and abuse prevention.
• Defend the Perimeter: Manage and tune our WAF and DDoS mitigation. You understand that in our industry, availability is revenue.
• Secure Cloud Infrastructure: Help harden our cloud environment where it matters most for application security.
• Automation & Scripting: Automate security checks, reduce manual toil, and ensure consistent controls across our pipelines and environments.
• Compliance Support: Act as the technical bridge for regulatory and ISO certifications.
• Business Partnership: Work closely with engineering and product teams. You will champion a "Security by Design" culture, helping stakeholders understand risk without acting as a blocker to innovation.
• Strategic partnership: Driving our collaboration with Google to architect the future of our AI workflows and security frameworks.

Qualifications

• AppSec Specialist: Strong background in securing high‑scale, consumer‑facing applications across mobile and web. Knowledge of the OWASP Top 10 and insights into its gaps.
• Code Reviewer: Ability to read and audit code in modern high‑level languages and use automated tools.
• Networking Native: Deep foundational understanding of networking protocols (TCP/IP, DNS, HTTP/S, TLS). Ability to secure traffic at the protocol level.
• Cloud‑Comfortable: Working knowledge of cloud security, Kubernetes, and microservices trade‑offs at scale.
• Regulated Background: Experience in industries with strict compliance requirements (iGaming, Fintech, or Healthcare) and understanding of the rigor required.
• Scripting Skills: Automation of security workflows with Python or similar.
• Pragmatic Communicator: Weigh business goals against security risk and explain to non‑technical stakeholders why a control matters.
• Provider Management: Experience evaluating, onboarding, and managing external security vendors or managed service providers.

Benefits

• Hybrid work policy (3 days a week of working from the office)
• 4 weeks of Workation (T&C apply)
• 300 EUR wellness contribution annually
• Cobee – benefits app with flexible compensation and discounts
• Health insurance (we use Alan)
• Life insurance
• Employee Assistance Program (free emotional, legal, and financial support)
• Short Fridays – we work until 16:00
• Complimentary snacks and drinks in our offices, Monday breakfast and Wednesday fika
• Team and office social events throughout the year
• Impact: Be a founding member of the security team, helping shape our application security practice and tooling from the ground up.
• High‑Stakes Challenge: Work in an environment where security directly affects user trust, real‑time operations, and the bottom line.