Senior Security Engineer

Our environment 

To give you a sense of what you would be working with, our setup includes: 

• Public cloud on GCP and AWS. 
• Workloads running on Kubernetes. 
• Infrastructure managed with Terraform and Ansible. 
• CI/CD built on Jenkins. 
• On-prem datacenters running VMware, KVM, and oVirt, along with our own network equipment and firewalls. 
• Many third-party services, including CDNs and DNS providers. 

What you'll do 

Harden our infrastructure and cloud 

• Secure our cloud environments (GCP, AWS) and on-prem datacenters: configuration, network segmentation, firewalls, encryption, and access. 
• Build guardrails so our cloud and compute platforms are safe by default, and set secure baselines and reusable patterns through Terraform and Ansible. 
• Harden our Kubernetes clusters: RBAC, network policy, workload isolation, and image hygiene. 
• Improve identity and access management across our systems: who can reach what, and why. 
• Manage secrets properly (e.g. keys, tokens, and certificates) so they are not scattered through code and pipelines. 

Build security into how we ship software 

• Add security checks into our CI/CD pipelines, such as code scanning (SAST), dependency scanning (SCA), secret scanning, and container image scanning, with sensible gates rather than noise. 
• Help protect our software supply chain, from build integrity to the third-party components we depend on. 
• Give engineers secure defaults, paved roads, and clear guidance, so the secure path is the easy path and security is built in rather than added later. 
• Do threat modeling and design reviews on new services and significant changes, and turn the findings into fixes. 
• Work alongside developers to fix issues, not just report them. 

Find and fix weaknesses 

• Run vulnerability scanning and management, prioritise by real risk rather than raw severity, and drive fixes to completion with clear tracking. 
• Arrange penetration tests, and turn the findings into fixes. 
• Review the security of our web platforms and APIs, with a focus on authorisation and abuse prevention. 
• Help protect the integrity of our games and platform, including the systems that must stay trustworthy for certification. 

Detect and respond 

• Build logging, monitoring, alerting, and detections so we can see what is happening across our systems, and tune them so alerts are worth acting on. 
• Detect, investigate, and respond to security incidents end to end: triage, containment, root cause, and recovery. 
• Write clear runbooks and playbooks, and run the occasional tabletop exercises. 
• Document what you build. 

Support compliance and certification 

• Provide the technical controls and evidence that back our compliance work, including ISO 27001 and GDPR. 
• Support game and RNG certification from a technical and security standpoint. 
• Review the security of our third-party services and suppliers. 

Make security easy for the rest of engineering 

• Act as a trusted advisor to the DevOps and engineering teams, and help implement fixes rather than only handing over recommendations. 
• Automate security work wherever it removes toil and gives us consistent controls across environments. 
• Raise the security awareness of the wider team through good defaults, documentation, and the occasional bit of training. 

What we're looking for

• Strong hands-on security engineering experience across several areas, for example cloud security, networks, identity, and application or pipeline security. 
• Practical experience securing public cloud environments and working with infrastructure as code and CI/CD pipelines. 
• Scripting and automation skills (e.g. Python or Bash); you are comfortable solving problems with code and building small tools when you need them. 
• Working knowledge of networking, firewalls, TLS/DNS, and containerised environments (Kubernetes). 
• Solid understanding of common web and application security risks (e.g. OWASP Top 10) and secure development practices. 
• Experience with vulnerability management, system hardening, and handling security incidents from start to finish. 
• A good understanding of at least one major security standard or framework, e.g. ISO 27001, NIST, CIS. 
• The judgement to prioritise: to tell a real risk from a theoretical one, and to focus effort where it counts. 
• Clear communication, and the ability to work well with engineers day to day and explain risk without drama. 
• Comfortable being an early security hire and building the foundations from scratch, and able to make progress without waiting for perfect information. 
• Fluent English (our working language, in a largely asynchronous team). 

Nice to have 

• Experience in iGaming, gambling, or another regulated industry such as payments or fintech. 
• Detection engineering experience: writing and tuning alerts and detections, ideally detection-as-code. 
• Deeper Kubernetes and container security experience (cluster hardening, admission control, service mesh, policy-as-code such as OPA/Gatekeeper or Kyverno). 
• Experience securing on-prem or virtualised infrastructure (e.g. VMware or KVM) and network equipment such as firewalls. 
• Familiarity with cloud security services and posture tooling (e.g. GuardDuty, Security Hub) and with a SIEM (e.g. Wazuh). 
• Experience with secrets management and PKI (e.g. HashiCorp Vault, certificates, mTLS). 
• Security certifications are welcome but not required. Any of the following is a plus: OSCP, CISSP, CCSP, GIAC/SANS, or cloud and Kubernetes security certifications (for example AWS Certified Security – Specialty, Google Professional Cloud Security Engineer, or CKS). Equivalent hands-on experience counts just as much. 

PLEASE NOTE THAT THIS IS A FULLY ON-SITE POSITION
Address: Swan Offices, Sos. Bucuresti Nord, nr. 15-25, Windsor Royal building.