Lead Security Engineer

h3Lead Security Engineer (Application Platform Security) /h3pGreen Island builds software for online casinos and land-based casino operations. Our platforms handle player accounts, personal data, payments, and game transactions. We’re looking for an experienced security engineer to take ownership of protecting those systems. /ph3About the role /h3pYou’ll work directly with our developers and management to find vulnerabilities, decide what needs attention first, and implement improvements. You should be comfortable reading application code, investigating how a system could be exploited, and making the changes needed to secure it. /ppAI is making it easier to search for vulnerabilities and test potential attacks. We want someone who understands that shift and can use the same tools to improve our defences, with the judgment to distinguish a plausible finding from a real problem. /ph3What you’ll do /h3ulliReview and test our applications, APIs, and infrastructure for exploitable weaknesses. Follow findings through to a fix and verify it in production. /liliExamine login, account recovery, sessions, and permissions to prevent account takeovers and unauthorised access to player data or back office functions. /liliReview deposits, withdrawals, balances, game settlements, and promotional credits for flaws that could allow transactions to be manipulated, duplicated, or processed incorrectly. /liliCheck the boundaries between players, casino operators, internal systems, and external providers. /liliImplement improvements in application code, cloud configuration, access controls, and secrets management. /liliBuild security checks into development and delivery. Turn findings into automated tests and shared protections so the same mistakes are harder to repeat. /liliUse AI where it helps with code analysis, vulnerability research, testing, and remediation. Reproduce findings and review the resulting changes. /liliImprove the logging and alerts needed to spot suspicious activity, and help the team investigate and contain security incidents. /liliCoordinate external penetration tests and follow up on findings. /liliGive management a clear view of the main risks, the work needed to address them, and what remains unresolved. /liliDefine and maintain practical security policies for access, sensitive data, software development, AI tools, and third-party services. Work with colleagues to put them into practice. /liliEstablish clear processes for granting, reviewing, and removing access, including onboarding, role changes, and offboarding. /liliWork with management to agree security priorities, assign responsibility, and document decisions about risks and exceptions. /liliTurn policies into technical controls where possible, including access restrictions, approval steps, automated checks, and audit trails. /liliAssess the security of new tools and suppliers before adoption, particularly where they can access customer data, source code, or production systems. /liliGive employees clear guidance and training on handling sensitive information, recognising phishing, using AI safely, and reporting security concerns. /liliMaintain an incident response plan with clear responsibilities and escalation paths, and practise it with the people involved. /liliSupport customer security reviews and relevant audits with accurate documentation and evidence of how controls operate. /li /ulh3Who you are /h3ulliSubstantial hands-on experience in application security, product security, or security engineering, including responsibility for production systems. /liliStrong programming skills. You can review unfamiliar code, write useful tooling, and implement fixes yourself. /liliExperience finding and resolving vulnerabilities in web applications and APIs, particularly around authentication, authorisation, sessions, and business logic. /liliA solid understanding of cloud security, networking, permissions, secrets, and software delivery pipelines. /liliThe ability to follow a transaction across several services and reason about what happens when requests fail, arrive twice, or run concurrently. /liliGood judgment about severity and priorities. You can explain how a vulnerability could affect customers or the business and propose a practical response. /liliClear written and spoken English, attention to detail, and the ability to work closely with developers and management. /liliExperience introducing security policies and processes that people can follow, and translating them into working technical and operational controls. /liliThe ability to discuss risk with management, explain decisions clearly, and get changes adopted across the company. /liliWe’ll be interested in examples of vulnerabilities you’ve found, fixes you’ve shipped, and improvements that continued to help after the immediate issue was resolved. /li /ulh3Nice to have /h3ulliSecuring payments, gaming platforms, or other systems that handle customer balances and sensitive data. /liliC# an