The Role
Own the company-wide security program, including strategy, risk management, cloud and application security, incident response, identity and access management, compliance, privacy, vendor risk, fraud prevention, AI security, and security awareness. Lead a SecOps engineer, partner with engineering, IT, Legal, and executives, manage audits and incidents, and secure employees, contractors, and offshore teams.
Summary Generated by Built In
Description
We run Crown Coins, a high-traffic social gaming platform on AWS and GCP. Players pay us, redeem prizes and trust us with their data. You’ll own our security program end to end: strategy, risk, compliance and incident response.
You’ll lead a SecOps engineer who sits inside our DevOps team. You’ll partner with the VP R&D on application security, and with Legal and IT on identity, access and compliance. This includes access and control for our external team in the Philippines.
Responsibilities- Security strategy and risk: Own the security roadmap and risk register. Report security risk to executive leadership in business terms.
- Security operations: Lead the SecOps engineer inside DevOps. Set priorities for cloud security (AWS + GCP), edge protection (Cloudflare), detection and response. Own the incident response plan and lead major incidents.
- Application security: Work with the VP R&D to build security into how we ship: threat modeling, code and dependency scanning, pentests and vulnerability management.
- Identity and access: Work with IT and Legal to set access policy for employees, contractors and our external Philippines team. This covers SSO, MFA, least privilege, onboarding and offboarding, access reviews, and device and browser controls (JumpCloud, Google Workspace, Island).
- Compliance and privacy: Work with Legal on regulatory, payment (PCI DSS) and privacy requirements. Own security audits and vendor risk for vendors and outsourcing partners.
- Fraud and abuse: Work with engineering and fraud analysis teams to cut bot abuse, account takeover and fraud before it costs us money.
- AI-first security: Drive the use of AI agents for alert triage, access reviews and compliance evidence. Set the guardrails for how the company uses AI tools safely.
- Security culture: Write policies people actually follow. Run security awareness training for employees and external staff.
- 7+ years in information security, including 3+ years leading a security program or team at a cloud-native tech company
- Deep hands-on knowledge of AWS security, plus working knowledge of GCP
- Built an incident response process and led real incidents through to post-incident fixes
- Identity and access management at scale: SSO, MFA and least privilege, including access for contractors or offshore teams
- Led security audits or certifications (SOC 2, PCI DSS or ISO 27001), and worked with Legal on regulatory and privacy requirements
- Built application security programs alongside engineering leaders
- Able to explain risk to executives, and hands-on enough to read Terraform, review alerts and challenge engineers on technical detail
- Experience using LLMs or AI agents to automate security work
Nice to have
- Security in gaming, sweepstakes, fintech or payments
- Fighting bots, fraud or account takeover at scale
- Securing offshore or BPO teams, including the Philippines Data Privacy Act
- Hands-on experience with Cloudflare, JumpCloud or Island Enterprise Browser
- Certifications such as CISSP, CISM, CCSP or AWS Security Specialty
Skills Required
- 7+ years of experience in information security
- 3+ years leading a security program or team at a cloud-native technology company
- Deep hands-on knowledge of AWS security and working knowledge of GCP
- Experience building incident response processes and leading real incidents through post-incident remediation
- Identity and access management experience at scale, including SSO, MFA, least privilege, contractors, and offshore teams
- Experience leading security audits or certifications such as SOC 2, PCI DSS, or ISO 27001
- Experience working with Legal on regulatory and privacy requirements
- Experience building application security programs with engineering leaders
- Ability to communicate security risk to executives
- Technical ability to read Terraform, review alerts, and challenge engineers on technical details
- Experience using LLMs or AI agents to automate security work
- Security experience in gaming, sweepstakes, fintech, or payments
- Experience fighting bots, fraud, or account takeover at scale
- Experience securing offshore or BPO teams, including knowledge of the Philippines Data Privacy Act
- Hands-on experience with Cloudflare, JumpCloud, or Island Enterprise Browser
- CISSP, CISM, CCSP, or AWS Security Specialty certification
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Sunflower is a Tel Aviv-based B2C gaming startup and game-software development company. It creates free-to-play social and entertainment games, using promotional rewards and popular social trends to build engaging experiences with fun twists, challenges, and achievements. Its multidisciplinary team spans development, art, marketing, game economy, and game design, with a mission to advance the global entertainment market and connect players.
