[Hiring] Senior Security Engineer @The Mill Adventure LTD

Role Description

The Senior Security Engineer will be the cornerstone of our product and cloud security posture. You will own security across the code, the cloud, the pipelines, the corporate estate, and the response when an alert comes in. This is a hands-on role with real architectural ownership.

• Architect and lead the design and implementation of security controls across our cloud infrastructure, applications and CI/CD pipelines — and build them yourself.
• Coach and mentor developers, engineers and architects on secure design, threat modelling and cloud security, so that security scales beyond the security team and becomes part of how we build.
• Own vulnerability management and our attack surface: know what is exposed, prioritise by real exploitability rather than scanner severity, and drive findings to closure with the teams that own them.
• Own the security of the SDLC by integrating and tuning SAST, DAST and SCA so that developers keep them enabled because the signal is worth the friction.
• Engineer and maintain our cloud security posture, primarily in AWS and Cloudflare — hardening configurations, automating compliance checks, and closing gaps before they are found for you.
• Own detection and response end to end: shape what we log and alert on, tune out the noise, investigate what is real, remediate it, and write up what happened.
• Architect and guide our IAM strategy, working with engineering to deliver least-privilege access for human and machine identities that teams don't route around.
• Test our own systems. Use offensive techniques against our infrastructure, applications and identity flows to validate that controls work and to decide what actually gets fixed first.
• Use AI as a force multiplier for a team that is small relative to its surface — agentic tooling for triage, code review, detection engineering, evidence collection and the automation of toil. You will also be the person who secures AI systems as we adopt them.
• Automate everything. If you would otherwise do it twice, automate it.
• Bring us the uncomfortable assessments — with a plan and a first PR attached.

Qualifications

• 5+ years hands-on in a technical security engineering role, including time where you were the person accountable for the fix, not the person who raised the ticket.
• You design and you deliver. You can produce an architecture that survives review, and you have a track record of the things you designed actually going live.
• Judgement across security engineering, IT security, security operations and offensive security.
• Deep AWS security: IAM, Organizations and SCPs, Security Hub, GuardDuty, WAF, plus Cloudflare.
• You write code that runs in production and that other people depend on — Python, Go, Bash, with TypeScript a major plus.
• Infrastructure as Code and its real failure modes: drift, over-permissive modules, secrets in state, pipeline privilege escalation.
• Vulnerability and attack surface management you have personally run.
• Solid understanding of SIEM and detection engineering.
• Detection and response you have personally done.
• Working offensive knowledge.
• Practical use of AI in your security work today.
• A current, specific view on AI-driven threats.
• SDLC security: SAST, DAST and SCA that you have integrated and tuned well enough that developers didn't turn them off.
• The ability to work autonomously without going dark, and to work closely with engineers without friction.
• Comfort with open technical debate.

Requirements

• Hands-on experience with PCI DSS — scoping, control implementation and evidence.
• Experience building and maintaining a SIEM: pipelines, parsing, cost control, detection-as-code.
• Serverless and event-driven architecture at scale.
• iGaming, fintech or another regulated, high-value-target industry.
• Corporate IT security: SSO and identity providers, MDM, SaaS security posture, third-party and vendor access.
• Experience securing AI or agentic systems.
• Security frameworks (NIST CSF, CIS Benchmarks, CSA CCM) used as tools to get work done.
• Public artifacts: tools you have released, writeups, CVEs, CTF results, talks.
• Certifications such as CISSP, AWS Certified Security or CEH are welcome.

Benefits

• A lean, focused company, offering a flexible working environment.
• The opportunity to work with and learn from a highly skilled, talented team.
• A great company culture, where accountability is innate, transparency is key and competency is virtue.
• Being part of a tight-knit, caring community.
• Work equipment of your choice.
• Private health insurance.
• Learning budget.
• Company-wide and team-based get-togethers.