Note: The job is a remote job and is open to candidates in USA. Hard Rock Digital is focused on becoming the best online sportsbook, casino, and social gaming company in the world. They are seeking a Principal Product Security Engineer to take ownership of security for their sportsbook and casino, ensuring secure software design and vulnerability management throughout the product lifecycle.
Responsibilities
- Embed automated checks across our cloud (GitHub Actions) and on-prem product pipelines — GitHub Advanced Security (SAST/SCA) and Wiz Code for application, dependency, and container scanning
- Define secure-by-default patterns, paved-road guardrails, and standards for secure coding, code review, and dependency hygiene — so teams ship quickly and safely
- Serve as the application authority for our Zero Trust program, aligned to NIST SP 800-207 and the CISA Zero Trust Maturity Model (Applications & Workloads pillar)
- Partner with product and engineering on security reviews for new features and payment integrations — running threat modeling (e.g., STRIDE) early in design and turning output into concrete, prioritized work
- Own the product and application vulnerability lifecycle — one program spanning code, dependency, container, pen-test, and bug-bounty findings, from discovery through remediation
- Prioritize by real-world risk and drive remediation against risk-based SLAs; engineering owns the fixes, you own the program and the escalation paths that shrink time to remediate
- Report program health with metrics leadership can act on, and provide evidence for compliance obligations (PCI DSS, GLI, ISO 27001, SOC 2)
- Defend our applications and APIs against the OWASP Top 10 and API abuse, partner on payment security across our payment gateways, and team with our Principal Cloud & Network Security Engineer — who owns our Cloudflare edge defenses (WAF, Bot Management) — on bot and abuse resilience
- Own the application security of player-facing account flows — registration, authentication, session management, recovery — partnering with our Principal Identity Engineer on CIAM architecture and with SecOps and Fraud on account-takeover resilience
- Coordinate penetration testing with external partners and drive findings to closure
- Mature our existing coordinated-disclosure program into a full bug-bounty capability
- You'll set priorities with the CISO; with GitHub Advanced Security, Wiz, and Cloudflare already live, you're building a program, not standing up scanners from zero
Skills
- 10+ years in application or product security — or equivalent practical experience
- Deep expertise across the AppSec toolchain: SAST, SCA, and secure code review
- Strong command of the vulnerability management lifecycle: triage, prioritization, remediation tracking, metrics
- Hands-on threat modeling and secure-design partnership with engineering teams
- Working knowledge of a modern programming language and how real applications are built and deployed
- Experience with CI/CD pipelines and cloud-native application security (our products run primarily on AWS)
- Excellent communication — you turn a finding into a clear, prioritized ask
- Fluency with AI — you lead with it, reaching for AI tools daily to work faster and sharper; hands-on experience applying AI to security or engineering work is a must
- Experience in a regulated industry (gaming, financial services, healthcare) — especially payments/PCI DSS or gaming standards (GLI-19, GLI-33)
- Experience running or maturing a bug-bounty or responsible-disclosure program
- DAST or API security testing experience — you'll help decide where it fits our stack
- Relevant certifications (e.g., OSCP, GWAPT, CSSLP, CISSP)
Benefits
- Competitive pay and benefits
- Flexible vacation allowance
- A hybrid / remote working environment
- Startup culture backed by a secure, global brand
Company Overview
Company H1B Sponsorship