ABOUT BETBY

As a fast-growing, award-winning company, Betby powers the industry with our premium sportsbook, featuring world-class risk management and seamless omni-channel support, reaching millions of players across countless markets.

With offices in Latvia, Malta, Spain, Greece and Montenegro, we offer a vibrant work culture, relocation opportunities, and full support for remote talent across the globe. Join Betby and unlock endless opportunities for growth, success, and making a real impact in the world of iGaming

SHORT DESCRIPTION

We are looking for a Senior Product Security Engineer to join our Application Security & Incident Response team. This is a senior, architect-level role. You will be the security design authority for product, engineering and functional teams working on our external and internal products and related business systems.

You will work independently. You will agree security requirements directly with team leads and stakeholders and coordinate with the GRC function on risk matters yourself. You will have the authority to block a release when the security risk is not acceptable, so you need the experience and judgement to weigh real risk against business needs.

This is a hands-on, operational role. You will own the security review flow from intake to sign-off. You will work alongside AppSec Analysts, who test implementations, DevSecOps Engineers, who build and run security tooling, and a GRC Specialist, who owns policies, the risk register and the third-party risk management process.

RESPONSIBILITIES

Security review flow

- Own the security review process from intake to sign-off, including risk-based triage and review triggers for high-risk changes.




- Embed security review into product delivery without slowing it down, and report on review coverage and flow metrics.

Security release authority

- Act as the security approver for in-scope changes, with the authority to block releases when residual risk is unacceptable and requires immediate escalation.
- Weigh security risk against business needs, propose workable alternatives, and document exceptions and risk acceptance decisions.

Threat modelling

- Facilitate threat modelling for features, services, integrations and architectural changes.
- Maintain threat models for the platform's critical flows and a reusable threat library.

Security design review and secure architecture

- Review technical designs, API contracts and integrations, and develop security requirements and acceptance criteria.
- Develop secure architecture patterns and define target-state designs and compensating controls for legacy constraints.

Security capability management

- Maintain security capabilities, map it against threat models, and drive closure of identified gaps.

Third-party technical security

- Perform technical security assessments of vendors, providers and integrations, and define technical security requirements for them.




- Support the technical security side of operator onboarding and integration.

Risk and GRC alignment

- Document identified risks and track them to remediation or formal acceptance in coordination with GRC.

Post-incident analysis

- Contribute design-level root cause analysis and preventive controls to post-incident reviews.

Enablement and reporting

- Support technical leads in owning threat mitigation for their solutions, and provide self-service guidance for low-risk changes.
- Report regularly on product security posture, release decisions and open risks.

REQUIREMENTS

- At least 5 years of experience in product security, application security or security architecture, including at least 3 years of hands-on threat modelling and/or security design review.
- Proven track record of facilitating threat modelling sessions (STRIDE, PASTA, attack trees or similar) and choosing the right depth for the risk of the change. Confident with data flow diagrams, trust boundaries and attack surface analysis.
- Proven experience making security go/no-go decisions on releases and designs. You should be able to justify a blocking decision with concrete risk, offer workable alternatives or compensating controls, and reach agreement with business stakeholders.
- Strong understanding of secure architecture for distributed systems: microservices, API gateways, reverse proxies and CDN/caching layers, message queues, and multi-tenant isolation patterns.
- In-depth practical knowledge of authentication, authorisation and integrity mechanisms: JWT/JWS validation, OAuth2/OIDC, mTLS, HMAC and asymmetric request signing, key management

📌 Senior Product Security Engineer (España)
🏢 Betby
📍 España