Senior Security Engineer, Anti-Abuse

📋 Job Overview

This is a company built for growth. When you join exmox, you're stepping onto a global, highly competitive playing field, solving real problems in environments that push you beyond your comfort zone. We move fast, cut the noise, and focus on what actually matters, because in our industry, speed wins. With 50M+ platform downloads, we’re rapidly scaling one of the most exciting innovations in mobile gaming: a rewarded user engagement and acquisition platform that helps players discover, and engage with games they enjoy - creating lasting value for both players and gaming studios.

🏢 About exmox

exmox pays out real money to real users, and that shapes our security posture. As Senior Security Engineer, Anti-Abuse (f/m/x), you'll be the first dedicated security hire, sitting inside the Platform Engineering team and owning the security vertical end to end in a cloud-native AWS environment running at scale. This isn't an advisory or reactive role: you'll design, prototype and incubate the defences that protect our payout ecosystem against cross-cutting abuse, and define how we handle a threat surface that AI is widening on both sides: cheap adaptive attack tooling, and the trust model around the AI coding agents in our own development workflow.

🎯 The Role

If you're excited by complex systems, high traffic, data-driven decisions, and the chance to grow by solving challenging problems, we want to hear from you.

✅ Key Responsibilities

• Application security: Secure design and code review across GraphQL, Python and Go services, finding logic flaws, broken trust boundaries, and authorization gaps, plus threat modelling with product teams during refinement, not after.
• Offensive testing: Hands-on testing of our own auth, session, and payout flows, before a release and before an external test, not only after.
• Abuse and fraud prevention: Defend against bots, credential stuffing, account takeover, multi-accounting, and payout fraud, working alongside our fraud team on per-account controls, step-up verification, and device and session signals.
• Edge defense: Own AWS WAF end to end, from managed and custom rule groups, rate-based rules and bot mitigation to the tuning loop that goes with it, plus CloudFront, origin protection, and DDoS posture as we move to a multi-region edge.
• Detection and response: Turn our full WAF logging and strong Datadog coverage into security detections that actually fire, and lead security incidents through technical response, postmortem, and follow-ups.
• Security in the SDLC and cloud: Build CI gates developers don't route around (secret detection, dependency and container scanning, SBOM), ship secure defaults in shared Helm and Terraform modules, and implement cloud and Kubernetes controls as code.
• Compliance and assurance: Coordinate external penetration testing and drive remediation, and own ISO 27001 readiness and GDPR-adjacent engineering as an engineering problem: mapping controls to what we already do and automating the evidence.

📌 Required Qualifications

• Engineering background: You write code, ideally Python and TypeScript (Go is a plus), and can read an unfamiliar service and find the logic flaw no scanner will catch.
• Application security depth: You know authentication and session design, authorization and trust boundaries, API and GraphQL security, injection classes, and secrets handling. You've fixed these bugs, not just filed them, and you validate a control by trying to break it yourself.
• Adversarial traffic: You have real experience with bot mitigation, credential stuffing, account takeover, rate limiting at scale, or fraud pressure, in any domain where someone is actively working against you. You think about where an attack actually pays off and design controls that make it not worth running.
• AWS WAF and detection engineering: You've written and tuned custom WAF rules, handled false positives against real users, and can go from raw logs to a working alert using SQL/Athena or equivalent and Datadog or comparable tooling.
• AWS and Kubernetes: You're fluent enough to implement controls yourself in Terraform and be credible in a Platform design review.
• Influence and ownership: You can write a design doc developers read, disagree without it becoming a standoff, and explain risk to leadership in terms of money. You've handled incidents with real customer impact, and you're comfortable being the only security person, sequencing priorities and saying \"not yet\" often.

⭐ Desirable Experience

• ISO 27001 or SOC 2 experience as an implementer, a marketplace, fintech, gaming, or ad-tech background (mobile attribution is a bonus), policy-as-code (Kyverno, OPA), and certifications such as AWS Security Specialty, CKS, or OSCP.

🎁 Benefits

Transport subsidy, learning budget, wellness and gym, workation, bi-weekly team lunches, and more. The perks are great, but the real reason people join and stay is the challenge, the ownership, and the drive to win together. Please note: this is not a remote only position, we offer you a flexible hybrid model here in Hamburg, Germany - working from home on Mondays & Fridays, coming to the office on Tuesday, Wednesday & Thursday!

🛂 Visa & Eligibility

Not specified.