Senior Staff Security Engineer

Fanatics Betting & Gaming; New York (NY); On-site; USD 180,000 - 240,000; Full time

Job summary

Fanatics Betting & Gaming is seeking a Senior Staff Security Engineer to join the Ecosystems Security team in New York. You will shape secure architecture across on-prem and cloud environments with a focus on application security and AI/ML system security.

You will mentor engineers, lead threat model reviews, contribute to security tooling, and participate in on-call incident leadership while collaborating with multiple product teams in New York.

Qualifications

• 12+ years in security engineering with 6+ years coding experience.
• Proficiency in Python, Java, or Go.
• Expert in application security and secure SDLC.
• Experience securing AI/LLM systems and model pipelines.
• AWS security services at scale across multi-account environments.
• WAF platforms and IaC with Terraform/Ansible.
• Identity protocols and CI/CD security.

Responsibilities

• Set secure architecture strategy across product and enterprise environments, including on-prem, cloud, and containerless environments.
• Lead threat model reviews for complex services and AI systems.
• Define AI security approach, securing model pipelines and data boundaries.
• Contribute production code to security tooling as an engineering partner.
• Mentor senior engineers and represent security in cross-functional architecture discussions.
• Participate in on-call rotation for incident escalations.

Skills

Security engineering

Hands-on software

12+ years experience

Python/Java/Go

Application security

AI security

AWS security

WAF platforms

IaC (Terraform/Ansible)

Identity protocols

CI/CD security

Security leadership

Certifications (OSCP/OSWE/OSCE/CISSP)

Tools

Terraform

Ansible

Cloudflare

Akamai

Fastly

AWS WAF

Job description

Fanatics is building a leading global digital sports platform. We ignite the passions of global sports fans and maximize the presence and reach for our hundreds of sports partners globally by offering products and services across Fanatics Commerce, Fanatics Collectibles, and Fanatics Betting & Gaming, allowing sports fans to Buy, Collect, and Bet. Through the Fanatics platform, sports fans can buy licensed fan gear, jerseys, lifestyle and streetwear products, headwear, and hardgoods; collect physical and digital trading cards, sports memorabilia, and other digital assets; and bet as the company builds its Sportsbook and iGaming platform. Fanatics has an established database of over 100 million global sports fans; a global partner network with approximately 900 sports properties, including major national and international professional sports leagues, players associations, teams, colleges, college conferences and retail partners, 2,500 athletes and celebrities, and 200 exclusive athletes; and over 2,000 retail locations, including its Lids retail stores. Our more than 22,000 employees are committed to relentlessly enhancing the fan experience and delighting sports fans globally.

About the Team

As a Senior Staff Security Engineer on the Fanatics Ecosystems Security team, you'll operate across the full breadth of our security domains, spanning application, AI, cloud, identity, and edge security. You'll leadsecurity reviews, deliver impactful tooling in close partnership with engineering teams, and drive securityprograms with efficiency and scale.

Responsibilities

• Set the secure architecture strategy across product and enterprise environments, including
  on-premises, cloud, and containerless environments, establishing patterns and guardrails that other
  engineers and security teams build on, with a primary focus on application security and AI/ML
  system security
• Lead threat model reviews for the most complex services and AI systems, including LLM-integrated
  products, agentic workflows, and model supply chains. (Be an Enabler)
• Define and evolve the org's approach to AI security, securing model pipelines, data and trust
  boundaries, third-party model integrations, and AI attack surfaces
• Contribute production code to product features and internal security tooling as a hands-on
  engineering partner
• Act as the technical escalation point across security domains, including AppSec, cloud, identity,
  CI/CD, and AI, providing efficient security input across multiple product teams and architecture
  reviews simultaneously
• Drive and scale security coding programs supporting immutable, version-controlled environments
  through infrastructure as code, detection as code, and other engineering security initiatives
• Mentor senior and staff level engineers, raising the security engineering bar across the organization
• Represent security in cross-functional and executive level architecture discussions, translating
  technical risk into business impact
• Participate in an on-call rotation to provide 24/7 support for incident escalations, serving as an
  escalation lead for the most complex incidents

Experience and Skills

• 12+ years of experience in security engineering or a related field, including 6+ years of hands-on
  software engineering experience
• Required: Strong proficiency developing and reviewing code in one or more programming
  languages, including Python, Java, or Go
• Deep expertise in application security, including secure SDLC integration, SAST/DAST/IAST tooling,
  manual code review, and API security.
• Demonstrated experience securing AI systems, including LLM application security, prompt injection
  defenses, data governance, secure agentic tool use, and emerging AI-specific threats
• Demonstrated expertise implementing AWS security services and best practices (CloudTrail,
  GuardDuty, CloudWatch, Security Hub) at scale across multi-account environments
• Hands-on experience managing WAF platforms (Cloudflare, Akamai, Fastly, AWS WAF or equivalent),
  including custom rule development, not just enabling managed rulesets
• Demonstrated experience leveraging infrastructure as code with tools such as Terraform or Ansible,
  including designing secure module patterns and policy-as-code guardrails
• Experience with identity management protocols (OAuth, SAML, OpenID Connect) and designing
  identity architecture across multiple business units or products
• Deep understanding of secure CI/CD pipeline design, able to define what a good release pipeline
  looks like, why each stage exists, and how to harden against supply chain and pipeline compromise
• Track record of influencing security strategy and roadmap at an organizational level, not just
  executing within a single team
• Relevant certifications such as OSCP, OSWE, OSCE, or CISSP

Depending on the role, your interview and onboarding experience may include in-person components, such as onsite interviews or Launching into Better: LIVE—a multi-day cultural immersion in New York City for full-time, non-seasonal hires. These sessions are designed to build connection and bring our culture to life, though specific travel and participation requirements will be confirmed based on your role and location. Your recruiter will provide clear guidance at each stage of the process.

Ranges will change based on country and state of residence, which are reflected in Geographical Zones defined by Fanatics Betting and Gaming. The range incorporates all of our Geographical Compensation Zones and is subject to change as the Zone associated with the actual offer is confirmed. In addition to the base and bonus, full-time employment, and more. For information about our benefits, please visithttps://benefitsatfanatics.com/

Accepted file types: pdf, doc, docx, txt, rtf

Enter manually

Accepted file types: pdf, doc, docx, txt, rtf

LinkedIn Profile

Website

Are you over the age of 18 ? * Select...

How did you hear about Fanatics? * Select...

Do you now require visa sponsorship for employment? * Select...

Will you in future require visa sponsorship to maintain work authorization? * Select...

Are you able to provide proof of your legal work authorization? * Select...

Are you now, or have you ever been employed by Fanatics, Inc. or any of its affiliates or subsidiaries? * Select...

Are you bound by any restrictive covenants (non-compete, non-solicitation)? * Select...

What is your base salary compensation expectation? *

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey.Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in Fanatics Betting & Gaming’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A \"disabled veteran\" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A \"recently separated veteran\" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An \"active duty wartime or campaign badge veteran\" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An \"Armed forces service medal veteran\" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.

Select...

Voluntary Self-Identification of Disability

Form CC-305

Page 1 of 1

OMB Control Number 1250-0005

Expires 04/30/2026

Why are you being asked to complete this form?

We are a federal contractor or subcontractor. The law requires us to provide equal employment opportunity to qualified people with disabilities. We have a goal of having at least 7% of our workers as people with disabilities. The law says we must measure our progress towards this goal. To do this, we must ask applicants and employees if they have a disability or have ever had one. People can become disabled, so we need to ask this question at least every five years.

Completing this form is voluntary, and we hope that you will choose to do so. Your answer is confidential. No one who makes hiring decisions will see it. Your decision to complete the form and your answer will not harm you in any way. If you want to learn more about the law or this form, visit the U.S. Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) website at www.dol.gov/ofccp .

How do you know if you have a disability?

A disability is a condition that substantially limits one or more of your “major life activities.” If you have or have ever had such a condition, you are a person with a disability. Disabilities include, but are not limited to:

• Alcohol or other substance use disorder (not currently using drugs illegally)
• Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS
• Blind or low vision
• Cancer (past or present)
• Cardiovascular or heart disease
• Celiac disease
• Cerebral palsy
• Deaf or serious difficulty hearing
• Diabetes
• Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders
• Epilepsy or other seizure disorder
• Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome
• Intellectual or developmental disability
• Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD
• Missing limbs or partially missing limbs
• Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports
• Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS)
• Neurodivergence, for example, attention-deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities
• Partial or complete paralysis (any cause)
• Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema
• Short stature (dwarfism)
• Traumatic brain injury

Disability Status Select...

PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a collection of information unless such collection displays a valid OMB control number. This survey should take about 5 minutes to complete.