[Hiring] Staff Security Engineer @Orangepeople

Role Description

We are building a high-growth platform that blends social gaming with innovative currency mechanics, creating seamless, real-time experiences across games. We're creating next-gen sweepstakes gaming experiences that are fast, fun, and highly scalable. As an early security leader, you'll have true ownership in shaping how security is built into our product, infrastructure, and culture from day one.

What You'll Own:

• Work hands-on with engineering to embed security into fast-moving development workflows, helping us ship quickly without compromising trust, safety, or system integrity.
• Embed security into every stage of the SDLC from design to deployment, ensuring systems are secure by design, not patched later.
• Lead secure code reviews across TypeScript/Node.js services and modern frontend stacks (React / Next.js / React Native).
• Partner with backend, frontend, SRE, and platform teams to proactively identify and mitigate risks in real-time systems, APIs, and payment flows.
• Drive threat modeling for new features and systems, especially those involving transactions, integrations, and shared platform services.
• Own the full vulnerability management lifecycle: discovery, triage, prioritization, remediation, and reporting.
• Implement and scale security tooling (SAST, DAST, SCA, secrets scanning) integrated into CI/CD pipelines.
• Establish secure architecture patterns for high-scale, real-time systems and transaction processing.
• Ensure auditability, data integrity, and traceability across critical systems.
• Define and execute the application security strategy and roadmap aligned with rapid product iteration.
• Act as a trusted partner to engineering, balancing risk with speed in a high-velocity startup environment.
• Build security guardrails that enable developers to move fast safely, not slow them down.
• Help shape broader security initiatives including infrastructure security, governance, and risk management.
• Support and lead security incident response, including root cause analysis and long-term remediation.
• Continuously improve security posture through automation, tooling, and developer education.

Qualifications

• 8+ years of experience in Application Security, Security Engineering, or Software Engineering with a strong security focus.
• Proven experience embedding security into modern SDLCs in fast-moving environments.
• Strong hands-on background in secure coding and code review (ideally in TypeScript / Node.js ecosystems).
• Deep understanding of common vulnerabilities (e.g., OWASP Top 10) and modern attack vectors.
• Experience with application security tooling (SAST, DAST, SCA) and integrating them into CI/CD pipelines.
• Strong experience with threat modeling and designing secure, scalable architectures.
• Familiarity with real-time, high-traffic systems, APIs, and distributed architectures.

Bonus Points

• Experience securing payments, transactions, or fintech-like systems (auditability, fraud considerations, traceability).
• Background in gaming, iGaming, or highly interactive real-time platforms.
• Experience working across cloud and/or on-prem infrastructure alongside SRE / platform teams.
• Familiarity with DevSecOps practices and security automation at scale.
• Experience in early-stage or hypergrowth startups where speed and ownership are critical.

Benefits

• 100% medical, dental & vision coverage (partial for dependents).
• 401(k) employer match.
• Annual performance bonus: 10% –15%.