Security Engineer

About us 

ARRISE is a global leader in software development and services for the iGaming industry, bringing together more than 2,500 professionals operating across more than 12 locations worldwide. 
 

From concept through to delivery, we combine technical expertise, creativity and industry knowledge to develop products, platforms and services that shape player experiences and support some of the industry's leading brands. 
 

We are best known for the work we deliver for Pragmatic Play, creating and supporting technology, products and specialists services enjoyed by millions of players worldwide. 

About the role 

Hands-on engineer to carry real load across the full AppSec surface: offensive testing, white-box code review, secure design reviews, Kubernetes/cloud security, AI/agentic security, and the app-layer side of live incidents. Fast SDLC, real-money platform under regulatory scrutiny. Builder/operator, not a scanner-driver or a report-forwarder.

What you will do 

• Offensive security & pentest (core)

  Authorized full-stack offensive testing of web, API (REST/GraphQL), and mobile — chained past PoC to real business impact, not OWASP checklist runs.
  Real exploitation craft: authentication and session abuse, authz/IDOR, OAuth2/OIDC and SSO/SAML flaws, token handling and JWT abuse, SSRF, business-logic abuse, anti-tamper and sandbox/runtime escape.
  Network/AD and cloud attack-path testing where engagements call for it.

   

• Code review, CI/CD security & shift-left (white-box)
  Manual source audit across Java, .NET/C#, Node.js, Python — finds the flaw class and the exploitable path, not just the scanner hit.
  Own SAST/SCA/DAST + SBOM in CI/CD: triage, tune out false positives, and gate releases without strangling delivery.
  Drive shift-left in practice — secure coding standards, pre-commit/PR guardrails, secrets scanning, policy-as-code, and getting developers to fix at the source.

   

• Secure architecture & design review
  Threat modeling (STRIDE/PASTA) and design-time reviews on new features and changes — set security conditions before code ships, not after.
  Review identity and trust boundaries: OAuth2/OIDC, SSO/SAML, session and key management, service-to-service auth, tenancy isolation.

   

• Cloud, container & Kubernetes security
  AWS security to real depth (IAM, CloudTrail, WAF, ALB/CloudFront, secrets, metadata abuse, cross-tenant isolation).
  Container and Kubernetes/EKS security — pod/workload hardening, escape paths, supply chain.

   

• AI / agentic security
  AppSec review and red teaming of LLM/agentic systems in production: prompt injection, jailbreaks, agent hijacking and tool-chain abuse, RAG poisoning, data leakage, guardrail and trust-boundary design.
  Comfortable with AI-assisted security tooling (agentic SAST / mass-scanning pipelines) as both builder and reviewer.

   

• IR from an AppSec standpoint (required)
  Owns the application layer of a live incident end to end: correlate app logs with CloudTrail / VPC flow / WAF, reconstruct the attack path, pinpoint the vulnerable code or config, confirm blast radius, drive the fix with the owning team.
  Recognizes real attack shapes fast - compromised container/host with a reverse shell, exposed internal APIs, credential/API-key exposure and rotation - and acts, rather than only escalating.

What you bring 

• 8+ yrs AppSec with genuine offensive and code-review depth; reads all four of Java/.NET/Node/Python, strong in two.
• Has taken findings to business impact and driven remediation to closure.
• AWS + Kubernetes security fundamentals, hands-on CI/CD security tooling

What sets you apart 

• Strongly preferred: OSWE (web code review) and OSCP.
• Offensive depth, any of: OSEP, OSED, CRTO, CRTP, Burp Suite Certified Practitioner, GWAPT.
• Cloud / container / IR, any of: AWS Security Specialty, CCSP, a Kubernetes security cert (e.g. CCNSE), GCIH, GCFA.
• AI security, any of: COAE (Certified Offensive AI Expert), OSAI, CAISP or equivalent.

 
What we offer 

• Competitive compensation 
• A competitive salary that reflects your skills and experience. 
• Annual leave 
• In accordance with the applicable legislation (20 or 26 days of annual leave). 
• Private medical cover 
• Private medical insurance to help you look after your health and wellbeing, available after successfully passing the probation period. 
• Learning Hub 
• Access to our online learning platform, with courses and resources to help you build your skills and grow your career. 
• Gym & fitness membership 
• Multisport membership, after successfully passing probation.