Senior Product Security Engineer job at BETBY, Da remoto

BETBY is hiring: Senior Product Security Engineer in Da remoto. ABOUT BETBY As a fast-growing, award-winning company, Betby powers the industry with our…

Company: BETBY · Location: Da remoto (Spagna) · Work mode: remote · Contract: Full-time

ABOUT BETBY
As a fast-growing, award-winning company, Betby powers the industry with our premium sportsbook, featuring world-class risk management and seamless omni-channel support, reaching millions of players across countless markets.
With offices in Latvia, Malta, Spain, Greece and Montenegro, we offer a vibrant work culture, relocation opportunities, and full support for remote talent across the globe. Join Betby and unlock endless opportunities for growth, success, and making a real impact in the world of iGaming!
SHORT DESCRIPTION
We are looking for a Senior Product Security Engineer to join our Application Security & Incident Response team. This is a senior, architect-level role. You will be the security design authority for product, engineering and functional teams working on our external and internal products and related business systems.
You will work independently. You will agree security requirements directly with team leads and stakeholders and coordinate with the GRC function on risk matters yourself. You will have the authority to block a release when the security risk is not acceptable, so you need the experience and judgement to weigh real risk against business needs.
This is a hands-on, operational role. You will own the security review flow from intake to sign-off. You will work alongside AppSec Analysts, who test implementations, DevSecOps Engineers, who build and run security tooling, and a GRC Specialist, who owns policies, the risk register and the third-party risk management process.
RESPONSIBILITIES
Security review flow
• Own the security review process from intake to sign-off, including risk-based triage and review triggers for high-risk changes.
• Embed security review into product delivery without slowing it down, and report on review coverage and flow metrics.
Security release authority
• Act as the security approver for in-scope changes, with the authority to block releases when residual risk is unacceptable and requires immediate escalation.
• Weigh security risk against business needs, propose workable alternatives, and document exceptions and risk acceptance decisions.
Threat modelling
• Facilitate threat modelling for features, services, integrations and architectural changes.
• Maintain threat models for the platform's critical flows and a reusable threat library.
Security design review and secure architecture
• Review technical designs, API contracts and integrations, and develop security requirements and acceptance criteria.
• Develop secure architecture patterns and define target-state designs and compensating controls for legacy constraints.
Security capability management
• Maintain security capabilities, map it against threat models, and drive closure of identified gaps.
Third-party technical security
• Perform technical security assessments of vendors, providers and integrations, and define technical security requirements for them.
• Support the technical security side of operator onboarding and integration.
Risk and GRC alignment
• Document identified risks and track them to remediation or formal acceptance in coordination with GRC.
Post-incident analysis
• Contribute design-level root cause analysis and preventive controls to post-incident reviews.
Enablement and reporting
• Support technical leads in owning threat mitigation for their solutions, and provide self-service guidance for low-risk changes.
• Report regularly on product security posture, release decisions and open risks.
REQUIREMENTS
• At least 5 years of experience in product security, application security or security architecture, including at least 3 years of hands-on threat modelling and/or security design review.
• Proven track record of facilitating threat modelling sessions (STRIDE, PASTA, attack trees or similar) and choosing the right depth for the risk of the change. Confident with data flow diagrams, trust boundaries and attack surface analysis.
• Proven experience making security go/no-go decisions on releases and designs. You should be able to justify a blocking decision with concrete risk, offer workable alternatives or compensating controls, and reach agreement with business stakeholders.
• Strong understanding of secure architecture for distributed systems: microservices, API gateways, reverse proxies and CDN/caching layers, message queues, and multi-tenant isolation patterns.
• In-depth practical knowledge of authentication, authorisation and integrity mechanisms: JWT/JWS validation, OAuth2/OIDC, mTLS, HMAC and asymmetric request signing, key management and rotation, replay protection and idempotency.
• Ability to turn threats into concrete, testable security requirements and acceptance criteria that developers can implement and AppSec/QA can verify.
• Solid understanding of business logic and abuse risks in transactional systems: race conditions, double processing, parameter and state tampering, precision/rounding issues, and authorisation boundaries between tenants.
• Experience performing technical security assessments of third-party vendors, SaaS products and API integrations: architecture, data flows, authentication, encryption, logging and resilience. You should be able to read assurance materials (SOC 2, ISO 27001, pentest summaries) critically from a technical perspective.
• Understanding of cloud and edge security architecture (AWS CloudFront, WAF, Shield or equivalents), Kubernetes-based deployments, and application-level resilience against DoS and resource exhaustion.
• Ability to produce clear, concise review outputs: threat models, design review conclusions, and risk statements with residual risk that both engineers and leadership can act on.
• Strong stakeholder management and negotiation skills. You should be able to agree security requirements with engineering, product and business teams without formal authority over them and without escalating to senior leadership.
• English at an upper-intermediate level or higher.
NICE TO HAVE
• Background in application security testing, penetration testing or software development that informs realistic threat assessment.
• Certifications such as CSSLP, OSWE, CCSP, AWS Certified Security – Specialty, CISSP-ISSAP or equivalents.
• Experience in the betting/gambling, payments or fintech industry, and awareness of industry-specific regulatory technical requirements.
• Experience with threat modelling tools or threat-modelling-as-code (OWASP Threat Dragon, IriusRisk, Threagile, Microsoft Threat Modeling Tool).
• Familiarity with OWASP ASVS, OWASP SAMM, NIST SSDF, MITRE ATT&CK and CAPEC as sources of requirements and threat libraries.
• Experience with post-incident analysis and identifying root causes at the design level.
• Experience assessing security of enterprise and SaaS integrations (ERP, collaboration suites, customer support platforms with custom authentication).
• Scripting skills (e.g. Python) to automate review workflows, Jira reporting or architecture checks.
BENEFITS
• Comprehensive health insurance with coverage for your well-being
• Paid sick leave up to 10 days without medical certificate
• 20 days of paid vacation plus additional leave for important life events
• Learning and growth opportunities with support for professional development
• Language learning support for multilingual collaboration
• Modern hardware provided for your work
• International team environment across multiple countries
• Corporate events and team activities
• Welfare support program for critical situations
• Gifts and support for major life milestones