{"id":3881141,"url":"https://alion.io/job/momentum-lead-application-security","title":"Lead, Application Security","company":{"id":4417175,"name":"Momentum","domain":"mgh.ae","url":"https://alion.io/company/mgh-2","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Abu Dhabi, United Arab Emirates"],"countries":["AE"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"AI Agents","optional":false},{"name":"Azure DevOps","optional":false},{"name":"Burp Suite","optional":false},{"name":"C#","optional":false},{"name":"Checkmarx","optional":false},{"name":"CI/CD","optional":false},{"name":"GitHub","optional":false},{"name":"GitHub Actions","optional":false},{"name":"GitLab CI","optional":false},{"name":"Go","optional":false},{"name":"Java","optional":false},{"name":"Kotlin","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Python","optional":false},{"name":"SBOM","optional":false},{"name":"Snyk","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"Veracode","optional":false},{"name":"Wiz","optional":false},{"name":"Azure","optional":true},{"name":"NIST AI RMF","optional":true},{"name":"Sigstore","optional":true},{"name":"SLSA","optional":true}],"status":"live","first_seen_at":"2026-11-06T14:28:52Z","employer_posted_date":"2026-11-06","last_verified_at":"2026-11-09T04:25:04Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"About Fanatics Momentum\nFanatics Momentum is building the UAE's leading regulated commercial gaming operator. Licensed by the General Commercial Gaming Regulatory Authority (GCGRA), we operate across lottery, iGaming, sportsbook, and digital content, combining Momentum's regional foundation with Fanatics' global product, technology, and scale. The business is ambitious, well-resourced, and moving fast. If you want to help build a category-defining operator in one of the world's most exciting regulated gaming markets, this is the right time to join.\nOverview \nWe're building a new UAE-based business spanning Sportsbook, Casino, Lottery and a broader connected Fan Ecosystem, backed by Fanatics and Momentum. As Lead, Application Security, you'll own application security testing and DevSecOps engineering end to end across FanMo's technology platforms. \nThis is a hands-on engineering leadership role. You'll be responsible for embedding security throughout the software development lifecycle, ensuring our applications, APIs, infrastructure and deployment pipelines are secure by default. You'll own the application security tooling ecosystem, engineer automated security controls into CI/CD pipelines, and build the guardrails and developer self-service capabilities that enable engineering teams to deliver securely at pace. \nWith AI increasingly changing how software is built, you'll also play a key role in making AI-assisted development secure by design. This means understanding the risks introduced by AI-generated code and agentic workflows, implementing practical security controls, and helping developers use AI coding assistants safely and effectively. \nThe ideal candidate combines strong software engineering fundamentals with an offensive security mindset. You're comfortable getting hands-on with code, validating vulnerabilities, automating security controls and influencing engineering teams. You know how to distinguish theoretical findings from genuine, exploitable risk and turn those insights into practical improvements. \nResponsibilities \nWhat You'll Own \nApplication Security & Testing \nOwn FanMo's application security testing capability across SAST, DAST, IAST, SCA, secrets detection, container scanning, infrastructure-as-code scanning, API security and mobile application testing.\nManage the full lifecycle of application security platforms, including evaluation, implementation, integration, configuration, upgrades and ongoing optimization.\nEstablish application onboarding, scanning policies, security rules and testing frequency based on application risk.\nTune existing rulesets and develop custom rules to improve accuracy and reduce false positives.\nBuild a consolidated view of application security risk, prioritizing findings based on exploitability and business impact.\nExtend application security testing to AI-generated code and AI-enabled product features. \nVulnerability Management & Developer Enablement \nOwn vulnerability triage, validation, prioritization and remediation tracking across application security findings.\nEstablish automated workflows to route findings to engineering teams, track remediation against agreed SLAs and verify closure.\nBuild developer self-service capabilities, including IDE integrations, secure templates, approved base images and hardened libraries.\nProvide practical, actionable remediation guidance directly to developers.\nEstablish and support a security champions network across engineering teams.\nDevelop secure-by-default instructions, reusable rules and skills for AI coding assistants to ensure generated code aligns with organizational security standards.\nDeliver targeted secure-coding education based on recurring vulnerabilities and root-cause analysis. \nOffensive-Informed Application Security \nValidate high and critical vulnerabilities through hands-on testing and proof-of-concept exploitation in non-production environments.\nConduct manual security testing of high-risk features, APIs and business logic ahead of release.\nTranslate confirmed exploits and penetration-testing findings into automated regression tests.\nDesign abuse-case testing for gaming-specific risks, including bonus and promotion abuse, wallet and balance race conditions, bet manipulation, account takeover and responsible-gaming control bypasses. \nSoftware Supply Chain Security \nDefine and implement security controls for dependency management, artifact signing, provenance verification and Software Bill of Materials (SBOM) generation.\nAssess third-party libraries, components and build dependencies for security risk.\nAddress AI-specific supply chain risks, including AI-suggested or non-existent packages, third-party models, MCP servers, plugins and IDE extensions.\nMonitor newly disclosed vulnerabilities in third-party components and drive prioritized remediation across affected applications. \nThreat Modeling & Secure Software Delivery \nEstablish repeatable threat-modeling practices for application changes, scaled according to risk.\nTranslate product security requirements into practical acceptance criteria, user stories and test cases.\nEmbed security evidence generation into CI/CD pipelines to support regulated platforms, releases, audits and certifications.\nThreat-model AI-enabled features and agentic workflows, including risks such as prompt injection, sensitive-data exposure and excessive agency.\nPartner with regulatory compliance and security teams to ensure application security evidence supports relevant regulatory and certification requirements. \nSecurity Automation, AI & Continuous Improvement \nBuild and maintain security automation and internal tooling where commercial solutions don't meet business requirements.\nApply engineering best practices to security tooling, including version control, peer review, testing and documentation.\nImplement guardrails for AI-assisted software development and test LLM-enabled product features against recognized security guidance, including the OWASP Top 10 for LLM Applications.\nLeverage approved AI capabilities for vulnerability triage, code analysis and documentation, with appropriate human oversight.\nEstablish performance reporting across application security, including testing coverage, pre-merge remediation rates, time to remediate, false-positive rates and automation efficiency.\nContinuously improve the effectiveness, reliability and adoption of security tooling across engineering. \nRequired Qualifications \n8+ years of experience across software engineering, DevOps or cybersecurity, including at least 4 years of hands-on application security delivery.\nProven experience owning and operating enterprise application security platforms such as HCL AppScan, Checkmarx, Veracode, Snyk, Wiz Code or GitHub Advanced Security.\nStrong hands-on experience across SAST, DAST, IAST, SCA, secrets detection and container scanning, including configuration and tuning at scale.\nExperience integrating and operating security controls within CI/CD platforms such as GitHub Actions, GitLab CI or Azure DevOps.\nProduction-quality coding experience in at least one of Python, Go, Java/Kotlin, C# or TypeScript.\nDeep understanding of the OWASP Top 10 and OWASP API Security Top 10, with the ability to identify, exploit and remediate vulnerable code.\nPractical web and API security testing experience, including authentication and authorization vulnerabilities, injection, SSRF, deserialization and race conditions.\nExperience using Burp Suite or equivalent application security testing tools.\nHands-on experience securing AI-assisted development environments, including AI coding assistants and agents.\nWorking knowledge of the OWASP Top 10 for LLM Applications and risks such as prompt injection.\nFamiliarity with container security, Kubernetes deployment security and infrastructure-as-code practices.\nStrong communication skills, with the ability to influence engineering teams and translate technical security risks into practical business recommendations.\nDemonstrated ability to take ownership, drive delivery and balance security requirements with engineering velocity. \nPreferred Qualifications \nExperience working in regulated industries such as gaming, payments, financial services or other high-assurance environments.\nKnowledge of software supply chain security frameworks and tooling, including SLSA, Sigstore, CycloneDX or SPDX.\nExperience securing real-time, high-transaction platforms and mobile applications.\nExperience establishing or managing a security champions program.\nFamiliarity with AI security and governance frameworks such as MITRE ATLAS, NIST AI RMF or ISO/IEC 42001.\nExperience building security tooling or automation using LLM APIs.\nRelevant degree or equivalent practical experience.\nIndustry certifications such as OSWE, OSCP, GWAPT or CSSLP. Demonstrable bug bounty contributions, CVEs or published security research are particularly valued. \nIf you possess some of these qualifications but not all of them, we still encourage you to apply! \nAt Fanatics Momentum, we’re proud to be a fair, transparent, and inclusive employer. We value diversity, collaboration, and innovation, and we’re committed to creating an environment where every team member can thrive. If you’re ready to grow your career and help us build Momentum, we’d love to hear from you.","description_format":"text","description_chars":9327,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security"],"lifecycle":[{"event":"open","at":"2026-11-06T18:12:15Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":33,"reasons":["conf:1","win:early"],"computed_at":"2026-11-08T05:47:12Z"},"pay":null,"html_url":"https://alion.io/job/momentum-lead-application-security","json_url":"https://alion.io/job/momentum-lead-application-security.json","meta":{"generated_at":"2026-11-09T05:00:24Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4834,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-10T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4417175},"rest":"https://alion.io/mcp/rest/get_company?id=4417175"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmomentum-lead-application-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmomentum-lead-application-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmomentum-lead-application-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/momentum-lead-application-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmomentum-lead-application-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3881141}},{"tool":"search_jobs","arguments":{"company":"mgh.ae","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3881141},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}