[Hiring] Senior Product Security Engineer @BETBY

Role Description

We are looking for a Senior Product Security Engineer to join our Application Security & Incident Response team. This is a senior, architect-level role. You will be the security design authority for product, engineering and functional teams working on our external and internal products and related business systems.

• Work independently and agree on security requirements directly with team leads and stakeholders.
• Coordinate with the GRC function on risk matters.
• Have the authority to block a release when the security risk is not acceptable.
• Own the security review flow from intake to sign-off.
• Work alongside AppSec Analysts, DevSecOps Engineers, and a GRC Specialist.

Responsibilities

• Security review flow: Own the security review process from intake to sign-off, including risk-based triage and review triggers for high-risk changes.
• Embed security review into product delivery without slowing it down, and report on review coverage and flow metrics.
• Security release authority: Act as the security approver for in-scope changes, with the authority to block releases when residual risk is unacceptable.
• Weigh security risk against business needs, propose workable alternatives, and document exceptions and risk acceptance decisions.
• Threat modelling: Facilitate threat modelling for features, services, integrations and architectural changes.
• Maintain threat models for the platform's critical flows and a reusable threat library.
• Security design review and secure architecture: Review technical designs, API contracts and integrations, and develop security requirements and acceptance criteria.
• Develop secure architecture patterns and define target-state designs and compensating controls for legacy constraints.
• Security capability management: Maintain security capabilities, map it against threat models, and drive closure of identified gaps.
• Third-party technical security: Perform technical security assessments of vendors, providers and integrations, and define technical security requirements for them.
• Support the technical security side of operator onboarding and integration.
• Risk and GRC alignment: Document identified risks and track them to remediation or formal acceptance in coordination with GRC.
• Post-incident analysis: Contribute design-level root cause analysis and preventive controls to post-incident reviews.
• Enablement and reporting: Support technical leads in owning threat mitigation for their solutions, and provide self-service guidance for low-risk changes.
• Report regularly on product security posture, release decisions and open risks.

Qualifications

• At least 5 years of experience in product security, application security or security architecture.
• At least 3 years of hands-on threat modelling and/or security design review experience.
• Proven track record of facilitating threat modelling sessions (STRIDE, PASTA, attack trees or similar).
• Strong understanding of secure architecture for distributed systems.
• In-depth practical knowledge of authentication, authorisation and integrity mechanisms.
• Ability to turn threats into concrete, testable security requirements.
• Solid understanding of business logic and abuse risks in transactional systems.
• Experience performing technical security assessments of third-party vendors.
• Understanding of cloud and edge security architecture.
• Ability to produce clear, concise review outputs.
• Strong stakeholder management and negotiation skills.
• English at an upper-intermediate level or higher.

Requirements

• Background in application security testing, penetration testing or software development.
• Certifications such as CSSLP, OSWE, CCSP, AWS Certified Security – Specialty, CISSP-ISSAP or equivalents.
• Experience in the betting/gambling, payments or fintech industry.
• Experience with threat modelling tools or threat-modelling-as-code.
• Familiarity with OWASP ASVS, OWASP SAMM, NIST SSDF, MITRE ATT&CK and CAPEC.
• Experience with post-incident analysis and identifying root causes at the design level.
• Experience assessing security of enterprise and SaaS integrations.
• Scripting skills (e.g. Python) to automate review workflows.

Benefits

• Comprehensive health insurance with coverage for your well-being.
• Paid sick leave up to 10 days without medical certificate.
• 20 days of paid vacation plus additional leave for important life events.
• Learning and growth opportunities with support for professional development.
• Language learning support for multilingual collaboration.
• Modern hardware provided for your work.
• International team environment across multiple countries.
• Corporate events and team activities.
• Welfare support program for critical situations.
• Gifts and support for major life milestones.