Product security engineer

BETBY; United States; À distance; USD 150 000 - 190 000; Plein temps

Avantages offerts par ce poste

Health insurance

Relocation opportunities

Remote talent across globe

Paid time off

Professional development

Language learning support

Modern hardware provided

Résumé du poste

BETBY is seeking a Senior Product Security Engineer to join the Application Security & Incident Response team. This architect-level role serves as the security design authority for product, engineering, and business systems, ensuring secure design across external and internal products.

You will own the threat modelling process, embed security review into product delivery, and act as security approver for changes with significant risk.

Qualifications

• At least 5 years of experience in product security, application security or security architecture, including at least 3 years of hands-on threat modelling and/or security design review.

Responsabilités

• Own the security review process from intake to sign-off, including risk-based triage and review triggers for high-risk changes.
• Embed security review into product delivery without slowing it down, and report on review coverage and flow metrics.
• Act as the security approver for in-scope changes, with the authority to block releases when residual risk is unacceptable and requires immediate escalation.
• Weigh security risk against business needs, propose workable alternatives, and document exceptions and risk acceptance decisions.
• Facilitate threat modelling for features, services, integrations and architectural changes.
• Maintain threat models for the platform's critical flows and a reusable threat library.
• Review technical designs, API contracts and integrations, and develop security requirements and acceptance criteria.
• Develop secure architecture patterns and define target-state designs and compensating controls for legacy constraints.
• Maintain security capabilities, map it against threat models, and drive closure of identified gaps.
• Perform technical security assessments of vendors, providers and integrations, and define technical security requirements for them.
• Support the technical security side of operator onboarding and integration.
• Document identified risks and track them to remediation or formal acceptance in coordination with GRC.
• Contribute design-level root cause analysis and preventive controls to post-incident reviews.
• Support technical leads in owning threat mitigation for their solutions, and provide self-service guidance for low-risk changes.
• Report regularly on product security posture, release decisions and open risks.

Connaissances

Threat Modeling

Security Architecture

Threat Assessment

Risk Management

Cloud Security

Description du poste

Описание:

We are looking for a Senior Product Security Engineer to join our Application Security & Incident Response team. This is a senior, architect-level role. You will be the security design authority for product, engineering and functional teams working on our external and internal products and related business systems.

Задачи:

• Own the security review process from intake to sign-off, including risk-based triage and review triggers for high-risk changes
• Embed security review into product delivery without slowing it down, and report on review coverage and flow metrics
• Act as the security approver for in-scope changes, with the authority to block releases when residual risk is unacceptable and requires immediate escalation
• Weigh security risk against business needs, propose workable alternatives, and document exceptions and risk acceptance decisions
• Facilitate threat modelling for features, services, integrations and architectural changes
• Maintain threat models for the platform's critical flows and a reusable threat library
• Review technical designs, API contracts and integrations, and develop security requirements and acceptance criteria
• Develop secure architecture patterns and define target-state designs and compensating controls for legacy constraints
• Maintain security capabilities, map it against threat models, and drive closure of identified gaps
• Perform technical security assessments of vendors, providers and integrations, and define technical security requirements for them
• Support the technical security side of operator onboarding and integration
• Document identified risks and track them to remediation or formal acceptance in coordination with GRC
• Contribute design-level root cause analysis and preventive controls to post-incident reviews
• Support technical leads in owning threat mitigation for their solutions, and provide self-service guidance for low-risk changes
• Report regularly on product security posture, release decisions and open risks

Требования:

• At least 5 years of experience in product security, application security or security architecture, including at least 3 years of hands-on threat modelling and/or security design review.
• Proven track record of facilitating threat modelling sessions (STRIDE, PASTA, attack trees or similar) and choosing the right depth for the risk of the change.
• Confident with data flow diagrams, trust boundaries and attack surface analysis.
• Proven experience making security go/no-go decisions on releases and designs.
• You should be able to justify a blocking decision with concrete risk, offer workable alternatives or compensating controls, and reach agreement with business stakeholders.
• Strong understanding of secure architecture for distributed systems: microservices, API gateways, reverse proxies and CDN/caching layers, message queues, and multi-tenant isolation patterns.
• In-depth practical knowledge of authentication, authorisation and integrity mechanisms: JWT/JWS validation, OAuth2/OIDC, mTLS, HMAC and asymmetric request signing, key management and rotation, replay protection and idempotency.
• Ability to turn threats into concrete, testable security requirements and acceptance criteria that developers can implement and AppSec/QA can verify.
• Solid understanding of business logic and abuse risks in transactional systems: race conditions, double processing, parameter and state tampering, precision/rounding issues, and authorisation boundaries between tenants.
• Experience performing technical security assessments of third-party vendors, SaaS products and API integrations: architecture, data flows, authentication, encryption, logging and resilience.
• You should be able to read assurance materials (SOC 2, ISO 27001, pentest summaries) critically from a technical perspective.
• Understanding of cloud and edge security architecture (AWS CloudFront, WAF, Shield or equivalents), Kubernetes-based deployments, and application-level resilience against DoS and resource exhaustion.
• Ability to produce clear, concise review outputs: threat models, design review conclusions, and risk statements with residual risk that both engineers and leadership can act on.
• Strong stakeholder management and negotiation skills.
• You should be able to agree security requirements with engineering, product and business teams without formal authority over them and without escalating to senior leadership.
• English at an upper-intermediate level or higher.

Будет плюсом:

• Background in application security testing, penetration testing or software development that informs realistic threat assessment;
• Certifications such as CSSLP, OSWE, CCSP, AWS Certified Security - Specialty, CISSP-ISSAP or equivalents;
• Experience in the betting/gambling, payments or fintech industry, and awareness of industry-specific regulatory technical requirements;
• Experience with threat modelling tools or threat-modelling-as-code (OWASP Threat Dragon, IriusRisk, Threagile, Microsoft Threat Modeling Tool);
• Familiarity with OWASP ASVS, OWASP SAMM, NIST SSDF, MITRE ATT&CK and CAPEC as sources of requirements and threat libraries;
• Experience with post-incident analysis and identifying root causes at the design level;
• Experience assessing security of enterprise and SaaS integrations (ERP, collaboration suites, customer support platforms with custom authentication);
• Scripting skills (e.g. Python) to automate review workflows, Jira reporting or architecture checks.

Условия:

• With offices in Latvia, Malta, Spain, Greece and Montenegro, we offer a vibrant work culture, relocation opportunities, and full support for remote talent across the globe.
• Comprehensive health insurance with coverage for your well-being
• Paid sick leave up to 10 days without medical certificate
• 20 days of paid vacation plus additional leave for important life events
• Learning and growth opportunities with support for professional development
• Language learning support for multilingual collaboration
• Modern hardware provided for your work
• International team environment across multiple countries
• Corporate events and team activities
• Welfare support program for critical situations
• Gifts and support for major life milestones