Senior Product Security Engineer (iGaming)

Location: Remote, with full support for remote talent across the globe; relocation opportunities are available.

Company

hirify.global develops a premium sportsbook with risk management and omni-channel support for millions of players across multiple markets.

What you will do

• Own the security review process from intake through sign-off, including risk-based triage, review triggers, coverage metrics, and self-service guidance.
• Act as security approver for in-scope changes, make release go/no-go decisions, block releases where residual risk is unacceptable, and document exceptions and risk acceptance.
• Facilitate threat modelling for features, services, integrations, and architecture changes; maintain critical-flow threat models and a reusable threat library.
• Review technical designs, API contracts, integrations, and secure architecture patterns; define security requirements, acceptance criteria, target-state designs, and compensating controls.
• Assess vendors, providers, SaaS products, and API integrations; support operator onboarding, post-incident root-cause analysis, and preventive controls.
• Coordinate with engineering, product, business, AppSec, DevSecOps, and GRC stakeholders while reporting on product security posture, release decisions, and open risks.

Requirements

• At least 5 years of experience in product security, application security, or security architecture, including at least 3 years of hands-on threat modelling and/or security design review.
• Experience facilitating STRIDE, PASTA, attack-tree, or similar threat-modelling sessions; confident use of data-flow diagrams, trust boundaries, and attack-surface analysis.
• Experience making and justifying security go/no-go decisions, proposing workable alternatives or compensating controls, and reaching agreement with business stakeholders.
• Strong understanding of secure distributed-system architecture, including microservices, API gateways, reverse proxies, CDN/caching layers, message queues, and multi-tenant isolation.
• Practical knowledge of JWT/JWS validation, OAuth2/OIDC, mTLS, HMAC and asymmetric request signing, key management and rotation, replay protection, and idempotency.
• Ability to turn threats into concrete, testable security requirements and acceptance criteria for developers, AppSec, and QA.
• Understanding of transactional business-logic and abuse risks, including race conditions, double processing, parameter and state tampering, precision and rounding issues, and tenant authorization boundaries.
• Experience assessing third-party vendors, SaaS products, and API integrations, including architecture, data flows, authentication, encryption, logging, resilience, and technical review of SOC 2, ISO 27001, and penetration-test materials.
• Understanding of AWS CloudFront, WAF, Shield or equivalents, Kubernetes deployments, and application resilience against DoS and resource exhaustion; strong stakeholder management and negotiation skills.
• English at upper-intermediate level or higher required.

Nice to have

• Application-security testing, penetration-testing, or software-development background.
• CSSLP, OSWE, CCSP, AWS Certified Security – Specialty, CISSP-ISSAP, or equivalent certification.
• Experience in betting/gambling, payments, or fintech and awareness of industry-specific regulatory technical requirements.
• Experience with OWASP Threat Dragon, IriusRisk, Threagile, Microsoft Threat Modeling Tool, or threat-modelling-as-code.
• Familiarity with OWASP ASVS, OWASP SAMM, NIST SSDF, MITRE ATT&CK, and CAPEC.
• Post-incident design-level root-cause analysis, enterprise or SaaS integration security assessments, and scripting with Python or similar tools.

Culture & Benefits

• Remote work with support for talent across the globe and an international team environment.
• Comprehensive health insurance and welfare support for critical situations.
• 20 days of paid vacation, additional leave for important life events, and up to 10 paid sick-leave days without a medical certificate.
• Learning and professional-development support, including language learning.
• Modern work hardware, corporate events, team activities, and support for major life milestones.