Senior Security Engineer

Senior Security Engineer About FairPlay Sports Media We’re a sports media network, focused on building and nurturing a portfolio of highly engaged and connected communities of sports fans and bettors to create value for our partners. We empower sports fans with real-time intelligence, premium independent content, and unique tools so they can compete in the sports betting game. FairPlay Sports Media is a collection of market-leading brands including oddschecker, WhoScored, SuperScommesse, FairPlay Technologies and Confido. iGaming is one of the fastest-growing and most technologically innovative sectors, and we're on top of our game, powered by market-leading tech and driven by brilliant people. Department: Technology / Engineering Reporting to: Director of IT, CPTO Location: Hybrid - Office travel on average once per month, London Waterloo Why this role exists FairPlay Sports Media is building a tech-led, AI and data-powered sports media network that serves both owned brands (e.g., oddschecker, WhoScored.com, SuperScommesse, and others) and partners with BetTech products spanning data, display, and predictive capabilities. At FairPlay scale - real-time data, high-frequency updates, and partner integrations - you’ll work with multiple engineering teams to deliver reliable, compliant, high-throughput product execution. What you’ll do We are looking for a hands-on, pragmatic, DevSecOps minded Senior Security Engineer to own and evolve the security posture of our Google Cloud Platform environment. Comfortable working across infrastructure, platforms, and pipelines, you will level up our InfoSec detection and response capabilities, harden our identity model toward Zero Trust, and build secure guardrails into our infrastructure-as-code and delivery pipelines. Key Responsibilities Pillar 1: Engineering & Infrastructure Security Automating security guardrails, so developers can ship safe code fast: GCP Infrastructure Security: Audit, harden, and monitor our GCP footprint (including Security Command Center, IAM PoLP, Cloud Armor, encryption at rest with KMS, OS Login, GKE Network Policies for zero-trust, and remediating default service accounts). SCA & Secrets: Integrate automated security scanning (SBOM, SAST, DAST) into GitLab pipelines, enforce policy-as-code across Terraform, route code-level vulnerabilities to owners, manage end-to-end secrets lifecycles (Google Secret Manager/KMS, rotation, access policies), and facilitate the remediation of hardcoded credentials by engineering teams. Logging & Observability: Define logging policies (including VPC Flow Logs for forensic visibility) and build security telemetry and reporting frameworks for real-time incident response. Workload & Host Hardening: Implement and automate Shielded VM configurations (Secure Boot, vTPM) across the compute fleet and ensure IaC deployments enforce security best practices. Internal Tooling & Automation: Maintain and build developer-facing tools using Python, Go, and modern frameworks. Pillar 2: Security Operations Protecting company assets and responding to threats: Vendor & Operational Oversight: Act as the primary technical interface with our MDR partner, ensuring seamless integration with internal NOC/SOC operations. InfoSec Operations: Lead security operations, enforcing Zero Trust access management principles, and infrastructure incident response, driving rapid incident detection and leading internal incident command for high-severity threats. Strategy & Principles: Collaborate with technical leadership to enhance our InfoSec, DevSecOps and AppSec policies and standards. Vulnerability & Perimeter Management: Own and evolve the end-to-end vulnerability scanning lifecycle and perimeter detection pipelines. Incident Response & On-Call: Working alongside our 24/7 MDR partner, this role takes part in a structured out-of-hours on-call rotation to lead incident response when required. All on-call duties and escalations are additionally compensated via callout pay. Threat Modelling: Conduct regular threat modelling sessions and architectural security reviews to identify and mitigate risks early in the development lifecycle. What we’re looking for Technical Skills & Experience Must have Experience: 5+ years in Security Engineering, Cloud Engineering, or SRE within a modern cloud environment. GCP & Containers: Deep hands-on expertise in GCP (IAM, Workload Identity, VPC, Org Policy, Security Command Center) and containerisation (Docker, Kubernetes). IaC & Pipeline Security: Strong proficiency with Terraform and deep experience managing CI/CD pipelines (GitLab CI) to embed automated security guardrails. DevSecOps Automation: Proficiency in scripting and development (Python, Go, or Bash) to build internal security tools. Security Architecture & Ops: Demonstrated ownership of incident response, detection engineering, vulnerability management, and WAF/DDoS mitigation. Zero Trust & IAM: Practical experience designing least-privilege IAM and maturing architectures toward Zero Trust models. Highly Desirable Relevant certifications (GCP Professional Cloud Security Engineer, GIAC, OSCP). Experience using the Google Cloud Architecture Framework. Experience with Chronicle, Wiz, or comparable CNAPP/SIEM tooling. Familiarity with compliance frameworks (SOC 2, ISO 27001) as engineering requirements. Soft Skills Ownership & Effective Problem-Solving: You are a pragmatic engineer who takes initiative, pursues problems to resolution, and balances speed with a meticulous attention to detail. Resilience & Autonomy: You demonstrate high emotional intelligence, self-organisation, and self-direction. Communication & Collaboration: You are an overcommunicator who clearly explains security risks and solution options to developers and engineering leadership. What you’ll get back from us Unlimited holiday plan Pension scheme with up to 9% contribution from the company Subsidised Sky HD package, broadband and discounted Sky Talk £1,000 training fund each financial year, to spend on your professional development Free PureGym membership Free healthcare with Bupa, life assurance and income protection Research shows that women and ethnic minorities are less likely to apply if they don’t meet every qualification. If you’re passionate about our purpose, determined to face challenges, and eager to learn, we encourage you to apply even if you don’t tick every box.