Security Engineer

BRAZY6k–6.5k USD

format:Remotetype:Full-timecompany:Product

awsazuregoogle cloudany one ofawslinuxdockerowasp asvssastdastiamsiemedrmdmpenetration testingosintrbacmfagoogle workspaceincident responsevulnerability managementapiapplication security

cloudflarewafcdnblockchaingdpr

englishB2

experience6+ years

domainiGaming

> full description

Hello, Brazy is looking for a Head of Cybersecurity for our projects.

Our business is growing: new projects are launching, our infrastructure and user base are expanding, and so is the attack surface. We are opening the Head of Cybersecurity role to build the security function from scratch and become the company’s key expert in protecting our products, infrastructure, and data.

We are a team of daring, innovative professionals. We are Cyberpunks, Cyber Jedi, and Pattern Breakers. Inspired by crazy ideas and a cool team, we create a quality product for the gaming industry and entertainment. We highly value intelligence, passion, and proactivity. We are constantly developing, and daily we struggle with routine and standards. We are changing the industry, changing the playing field so you can change the damn world.

Mission Brazy: To turn life into an interesting game!

Vision Brazy: To be one of the world leaders in the entertainment industry!

Location: Remote

Reporting to: CEO

Responsibilities:

— Build the cybersecurity function from scratch as a hands-on Head: strategy, roadmap, priorities, budget, security vendors and tools

— Run an assessment of current products and infrastructure, identify key risks, and build a remediation plan

— Develop and implement security policies, standards and procedures: access management, incident response, vulnerability management, data protection

— Own infrastructure and cloud security together with DevOps: network security, hardening, secrets management, logging and monitoring

— Embed security into the development lifecycle: secure SDLC practices, SAST/DAST, dependency scanning, regular penetration tests

— Review and strengthen access and corporate security: RBAC, MFA, least-privilege access, onboarding and offboarding, device management (MDM), password management, Google Workspace and SaaS security

— Protect products and users from threats typical for iGaming: DDoS, account takeover, credential stuffing, API abuse

— Build incident detection and response: monitoring, alerting, playbooks, investigations and post-mortems

— Protect the brand and key people: detection and takedown of phishing, clone sites and fake accounts, protection of corporate social media accounts, OSINT monitoring of leaks and doxxing risks, OPSEC, and security awareness training

Requirements:

— 6+ years of experience in information security/cybersecurity, including 2+ years in a leadership role (Head of Security, Security Lead, CISO, Security Manager)

— Proven experience building a security function or core security processes from scratch in a product company

— Strong hands-on expertise in infrastructure and cloud security with at least one major cloud provider (AWS, GCP or Azure), Linux and containers

— Solid knowledge of application and API security: OWASP Top 10, SAST/DAST, coordination of penetration tests

— Practical experience with IAM, SIEM / log management, EDR, MDM and vulnerability management

— Hands-on experience leading response to real security incidents: DDoS, account takeover, data breaches and leaks, phishing and brand impersonation, including investigation and forensics

— Practical experience with OSINT and OPSEC: monitoring of leaks, fake accounts and doxxing risks, protection of corporate social media accounts and key people

— Ability to work directly with the CEO: explain risks in business terms, prioritize by real impact, and communicate clearly during incidents

— English at a level sufficient for working with documentation, vendors, and auditors

— Ukrainian and Russian at a level sufficient for day-to-day internal communication within the team