Senior Security Engineer, Anti-Abuse (f/m/x)

Location: Hamburg, Germany; flexible hybrid model with work from home on Mondays and Fridays and office attendance on Tuesdays, Wednesdays, and Thursdays.

Company

hirify.global operates a rewarded user engagement and acquisition platform for mobile games, with more than 50 million platform downloads and real-money payouts to users.

What you will do

• Own the security vertical within Platform Engineering across a cloud-native AWS environment.
• Secure GraphQL, Python, and Go services through design reviews, code reviews, threat modeling, and hands-on offensive testing.
• Build defenses against bots, credential stuffing, account takeover, multi-accounting, and payout fraud with fraud specialists.
• Manage AWS WAF, CloudFront, origin protection, DDoS posture, custom rules, rate limiting, and bot mitigation for a multi-region edge.
• Turn WAF and Datadog data into detections, lead incident response and postmortems, and coordinate remediation.
• Build secure SDLC and cloud controls, including CI gates, secret and dependency scanning, SBOMs, Helm and Terraform defaults, Kubernetes controls, penetration testing, and ISO 27001 readiness.

Requirements

• Ability to write code, ideally in Python and TypeScript; Go experience is a plus.
• Strong application security experience covering authentication, session design, authorization, trust boundaries, API and GraphQL security, injection classes, and secrets handling.
• Hands-on experience finding and fixing security flaws and validating controls through offensive testing.
• Experience with adversarial traffic, including bot mitigation, credential stuffing, account takeover, large-scale rate limiting, or fraud prevention.
• Experience writing and tuning custom AWS WAF rules, handling false positives, and building alerts from raw logs using SQL/Athena or equivalent together with Datadog or comparable tooling.
• Ability to implement AWS and Kubernetes controls in Terraform and contribute credibly to platform design reviews.
• Ability to write design documents, communicate disagreements constructively, explain risk to leadership in financial terms, and handle incidents with customer impact.
• Comfort working as the only security specialist, setting priorities, and making trade-offs.

Nice to have

• ISO 27001 or SOC 2 implementation experience.
• Marketplace, fintech, gaming, or ad-tech experience; mobile attribution experience is a bonus.
• Experience with policy-as-code, including Kyverno or OPA.
• Certifications such as AWS Security Specialty, CKS, or OSCP.

Culture & Benefits

• Fast-paced environment focused on experimentation, direct communication, and practical outcomes.
• Ownership-oriented culture where employees are expected to identify and solve problems.
• Respectful collaboration and open disagreement focused on ideas.
• Transport subsidy, learning budget, wellness and gym benefits, workation, and bi-weekly team lunches.
• Hybrid work arrangement based in Hamburg.