Senior Security Engineer, Anti-Abuse (f/m/x)
Exmox GmbH2 days ago
Hamburg, GermanySenior
Responsibilities
- Conduct secure design reviews, code reviews, threat modeling, and offensive testing across GraphQL, Python, and Go services.
- Defend against bots, credential stuffing, account takeover, multi-accounting, and payout fraud using account, verification, device, and session controls.
- Own AWS WAF, including custom rules, rate limiting, bot mitigation, CloudFront, origin protection, and DDoS posture.
- Build security detections from WAF logs and Datadog coverage and lead technical incident response, postmortems, and follow-up actions.
- Implement security gates for secret detection, dependency and container scanning, SBOMs, and secure Terraform and Helm defaults.
- Implement cloud and Kubernetes security controls as code.
- Coordinate external penetration tests, remediation, ISO 27001 readiness, and automated compliance evidence.
Requirements
- Hands-on software engineering experience with Python and TypeScript; Go experience is a plus.
- Deep application security experience covering authentication, sessions, authorization, trust boundaries, APIs, GraphQL, injection classes, and secrets handling.
- Practical experience with bot mitigation, credential stuffing, account takeover, rate limiting at scale, or fraud prevention.
- Experience writing and tuning custom AWS WAF rules and creating detections from logs using SQL/Athena or equivalent and Datadog or comparable tooling.
- Fluency with AWS, Kubernetes, and Terraform sufficient to implement controls and participate in platform design reviews.
- Experience handling security incidents with customer impact and operating with substantial ownership as the sole security specialist.
- Ability to communicate technical risk to developers and leadership.
- Preferred: ISO 27001 or SOC 2 implementation experience, marketplace, fintech, gaming, or ad-tech experience, policy-as-code knowledge with Kyverno or OPA, and certifications such as AWS Security Specialty, CKS, or OSCP.
Benefits
- Flexible hybrid work in Hamburg, Germany, with work-from-home on Mondays and Fridays and office work Tuesday through Thursday.
- Transport subsidy, learning budget, wellness and gym benefits, workation, and bi-weekly team lunches.
Tech Stack
Categories
About Exmox GmbH
Exmox builds an engagement-driven user acquisition platform for mobile games, helping publishers scale and retain audiences on Android and iOS through customized reward funnels and performance advertising. The company operates as a marketing partner to gaming studios, monetizing via campaign spend tied to measurable outcomes. Founded in 2015 and headquartered in Hamburg, it is privately held and part of the Aonic Group.