Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 3 hours agoWe saw it 85 min after it went up

Senior Product Security Engineer

BETBY

Where
Spain
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSenior Product Security EngineerBETBY · Spain

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on BETBY's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.4% of postings close within 7 days. Measured by our own scanner across the market.

Share of postings closed within
  1. 2.2%1 day
  2. 4.6%3 days
  3. 13.4%7 days
  4. 21.6%14 days
  5. 36.2%30 days
  6. 59.0%60 days
This job: posted 3 hours ago

The posting

ABOUT BETBY

As a fast-growing, award-winning company, Betby powers the industry with our premium sportsbook, featuring world-class risk management and seamless omni-channel support, reaching millions of players across countless markets.

With offices in Latvia, Malta, Spain, Greece and Montenegro, we offer a vibrant work culture, relocation opportunities, and full support for remote talent across the globe. Join Betby and unlock endless opportunities for growth, success, and making a real impact in the world of iGaming!

SHORT DESCRIPTION

We are looking for a Senior Product Security Engineer to join our Application Security & Incident Response team. This is a senior, architect-level role. You will be the security design authority for product, engineering and functional teams working on our external and internal products and related business systems.

You will work independently. You will agree security requirements directly with team leads and stakeholders and coordinate with the GRC function on risk matters yourself. You will have the authority to block a release when the security risk is not acceptable, so you need the experience and judgement to weigh real risk against business needs.

This is a hands-on, operational role. You will own the security review flow from intake to sign-off. You will work alongside AppSec Analysts, who test implementations, DevSecOps Engineers, who build and run security tooling, and a GRC Specialist, who owns policies, the risk register and the third-party risk management process.

RESPONSIBILITIES

Security review flow

  • Own the security review process from intake to sign-off, including risk-based triage and review triggers for high-risk changes.
  • Embed security review into product delivery without slowing it down, and report on review coverage and flow metrics.

Security release authority

  • Act as the security approver for in-scope changes, with the authority to block releases when residual risk is unacceptable and requires immediate escalation.
  • Weigh security risk against business needs, propose workable alternatives, and document exceptions and risk acceptance decisions.

Threat modelling

  • Facilitate threat modelling for features, services, integrations and architectural changes.
  • Maintain threat models for the platform's critical flows and a reusable threat library.

Security design review and secure architecture

  • Review technical designs, API contracts and integrations, and develop security requirements and acceptance criteria.
  • Develop secure architecture patterns and define target-state designs and compensating controls for legacy constraints.

Security capability management

  • Maintain security capabilities, map it against threat models, and drive closure of identified gaps.

Third-party technical security

  • Perform technical security assessments of vendors, providers and integrations, and define technical security requirements for them.
  • Support the technical security side of operator onboarding and integration.

Risk and GRC alignment

  • Document identified risks and track them to remediation or formal acceptance in coordination with GRC.

Post-incident analysis

  • Contribute design-level root cause analysis and preventive controls to post-incident reviews.

Enablement and reporting

  • Support technical leads in owning threat mitigation for their solutions, and provide self-service guidance for low-risk changes.
  • Report regularly on product security posture, release decisions and open risks.

REQUIREMENTS

  • At least 5 years of experience in product security, application security or security architecture, including at least 3 years of hands-on threat modelling and/or security design review.
  • Proven track record of facilitating threat modelling sessions (STRIDE, PASTA, attack trees or similar) and choosing the right depth for the risk of the change. Confident with data flow diagrams, trust boundaries and attack surface analysis.
  • Proven experience making security go/no-go decisions on releases and designs. You should be able to justify a blocking decision with concrete risk, offer workable alternatives or compensating controls, and reach agreement with business stakeholders.
  • Strong understanding of secure architecture for distributed systems: microservices, API gateways, reverse proxies and CDN/caching layers, message queues, and multi-tenant isolation patterns.
  • In-depth practical knowledge of authentication, authorisation and integrity mechanisms: JWT/JWS validation, OAuth2/OIDC, mTLS, HMAC and asymmetric request signing, key management and rotation, replay protection and idempotency.
  • Ability to turn threats into concrete, testable security requirements and acceptance criteria that developers can implement and AppSec/QA can verify.
  • Solid understanding of business logic and abuse risks in transactional systems: race conditions, double processing, parameter and state tampering, precision/rounding issues, and authorisation boundaries between tenants.
  • Experience performing technical security assessments of third-party vendors, SaaS products and API integrations: architecture, data flows, authentication, encryption, logging and resilience. You should be able to read assurance materials (SOC 2, ISO 27001, pentest summaries) critically from a technical perspective.
  • Understanding of cloud and edge security architecture (AWS CloudFront, WAF, Shield or equivalents), Kubernetes-based deployments, and application-level resilience against DoS and resource exhaustion.
  • Ability to produce clear, concise review outputs: threat models, design review conclusions, and risk statements with residual risk that both engineers and leadership can act on.
  • Strong stakeholder management and negotiation skills. You should be able to agree security requirements with engineering, product and business teams without formal authority over them and without escalating to senior leadership.
  • English at an upper-intermediate level or higher.

NICE TO HAVE

  • Background in application security testing, penetration testing or software development that informs realistic threat assessment.
  • Certifications such as CSSLP, OSWE, CCSP, AWS Certified Security – Specialty, CISSP-ISSAP or equivalents.
  • Experience in the betting/gambling, payments or fintech industry, and awareness of industry-specific regulatory technical requirements.
  • Experience with threat modelling tools or threat-modelling-as-code (OWASP Threat Dragon, IriusRisk, Threagile, Microsoft Threat Modeling Tool).
  • Familiarity with OWASP ASVS, OWASP SAMM, NIST SSDF, MITRE ATT&CK and CAPEC as sources of requirements and threat libraries.
  • Experience with post-incident analysis and identifying root causes at the design level.
  • Experience assessing security of enterprise and SaaS integrations (ERP, collaboration suites, customer support platforms with custom authentication).
  • Scripting skills (e.g. Python) to automate review workflows, Jira reporting or architecture checks.

BENEFITS

  • Comprehensive health insurance with coverage for your well-being
  • Paid sick leave up to 10 days without medical certificate
  • 20 days of paid vacation plus additional leave for important life events
  • Learning and growth opportunities with support for professional development
  • Language learning support for multilingual collaboration
  • Modern hardware provided for your work
  • International team environment across multiple countries
  • Corporate events and team activities
  • Welfare support program for critical situations
  • Gifts and support for major life milestones
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against BETBY's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on BETBY's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    BETBY's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.