Back to careersCareers at Green Island

Lead Security Engineer (Application & Platform Security)

Green Island builds software for online casinos and land-based casino operations. Our platforms handle player accounts, personal data, payments, and game transactions. We’re looking for an experienced security engineer to take ownership of protecting those systems.

About the role

You’ll work directly with our developers and management to find vulnerabilities, decide what needs attention first, and implement improvements. You should be comfortable reading application code, investigating how a system could be exploited, and making the changes needed to secure it.

AI is making it easier to search for vulnerabilities and test potential attacks. We want someone who understands that shift and can use the same tools to improve our defences, with the judgment to distinguish a plausible finding from a real problem.

What you’ll do

Review and test our applications, APIs, and infrastructure for exploitable weaknesses. Follow findings through to a fix and verify it in production.
Examine login, account recovery, sessions, and permissions to prevent account takeovers and unauthorised access to player data or back office functions.
Review deposits, withdrawals, balances, game settlements, and promotional credits for flaws that could allow transactions to be manipulated, duplicated, or processed incorrectly.
Check the boundaries between players, casino operators, internal systems, and external providers.
Implement improvements in application code, cloud configuration, access controls, and secrets management.
Build security checks into development and delivery. Turn findings into automated tests and shared protections so the same mistakes are harder to repeat.
Use AI where it helps with code analysis, vulnerability research, testing, and remediation. Reproduce findings and review the resulting changes.
Improve the logging and alerts needed to spot suspicious activity, and help the team investigate and contain security incidents.
Coordinate external penetration tests and follow up on findings.
Give management a clear view of the main risks, the work needed to address them, and what remains unresolved.
Define and maintain practical security policies for access, sensitive data, software development, AI tools, and third-party services. Work with colleagues to put them into practice.
Establish clear processes for granting, reviewing, and removing access, including onboarding, role changes, and offboarding.
Work with management to agree security priorities, assign responsibility, and document decisions about risks and exceptions.
Turn policies into technical controls where possible, including access restrictions, approval steps, automated checks, and audit trails.
Assess the security of new tools and suppliers before adoption, particularly where they can access customer data, source code, or production systems.
Give employees clear guidance and training on handling sensitive information, recognising phishing, using AI safely, and reporting security concerns.
Maintain an incident response plan with clear responsibilities and escalation paths, and practise it with the people involved.
Support customer security reviews and relevant audits with accurate documentation and evidence of how controls operate.

Who you are

Substantial hands-on experience in application security, product security, or security engineering, including responsibility for production systems.
Strong programming skills. You can review unfamiliar code, write useful tooling, and implement fixes yourself.
Experience finding and resolving vulnerabilities in web applications and APIs, particularly around authentication, authorisation, sessions, and business logic.
A solid understanding of cloud security, networking, permissions, secrets, and software delivery pipelines.
The ability to follow a transaction across several services and reason about what happens when requests fail, arrive twice, or run concurrently.
Good judgment about severity and priorities. You can explain how a vulnerability could affect customers or the business and propose a practical response.
Clear written and spoken English, attention to detail, and the ability to work closely with developers and management.
Experience introducing security policies and processes that people can follow, and translating them into working technical and operational controls.
The ability to discuss risk with management, explain decisions clearly, and get changes adopted across the company.
We’ll be interested in examples of vulnerabilities you’ve found, fixes you’ve shipped, and improvements that continued to help after the immediate issue was resolved.

Nice to have

Securing payments, gaming platforms, or other systems that handle customer balances and sensitive data.
C# and .NET, Java and Spring Boot, TypeScript, React, or AWS.
AI-driven development, security testing, or vulnerability research.
Penetration testing, bug-bounty research, or building security automation.
Investigating security incidents and improving detection afterwards.

What you get