Security engineer in gaming

Chess.com is one of the largest gaming sites in the world and the #1 platform for playing, learning, and enjoying chess. We are a team of 600+ fully remote people in 60+ countries working hard to serve the global chess community. We are here to support 250M+ chess players worldwide with the best possible product, content, and tools to serve the community!

• Lead vulnerability management program by triaging, reproducing, and assessing security vulnerabilities submitted through Bug Bounty programs, working directly with engineering teams to prioritize and remediate discovered security gaps
• Conduct comprehensive threat modeling by collaborating with engineering teams to analyze proposed solutions, ensuring designs meet security industry standards and identifying potential attack vectors before implementation
• Manage security incident response by reviewing penetration testing results and SIEM reports, translating technical findings into actionable remediation tasks, and tracking resolution progress through completion
• Optimize security infrastructure by applying updates to Web Application Firewalls (WAF) and other security systems, ensuring configurations align with current threat landscape and organizational needs
• Drive security tool evaluation and implementation by researching, evaluating, and recommending security software solutions, attending vendor demonstrations, and leading procurement processes from requirements gathering through deployment
• Provide security consultation and guidance by serving as subject matter expert to development teams, ensuring security best practices are integrated into software development lifecycle and architectural decisions
• Maintain security awareness and documentation by communicating security updates, progress reports, and recommendations to stakeholders through established channels and maintaining current security policies and procedures

• Bachelor's degree in Computer Science, Information Security, or related technical field, or equivalent professional experience
• Minimum 3+ years of professional experience specifically in web application security
• Demonstrated expertise with security testing tools such as Burp Suite or equivalent web request analysis and tampering tools
• Strong written communication skills in English with ability to clearly explain technical security concepts to diverse audiences
• Experience working effectively in fully distributed/remote team environments
• Proven ability to collaborate cross-functionally with engineering and development teams
• Будет плюсом: Previous hands-on experience managing or participating in Bug Bounty programs; Programming experience in PHP or JavaScript; Experience with penetration testing methodologies and tools; Knowledge of SIEM platforms and security monitoring systems; Familiarity with Web Application Firewall (WAF) configuration and management; Understanding of secure software development lifecycle (SDLC) practices; Experience with Jira or similar project management and issue tracking systems; Strong sense of ownership and accountability in a flat organizational structure; Passion for continuous learning and staying current with evolving security threats and technologies

• This is a full-time opportunity
• We are 100% remote (work from anywhere!)