Staff Engineer - Security

SpinQuest is building a high-growth social gaming platform with innovative currency mechanics and scalable, real-time gaming experiences. The Staff Engineer - Security will shape security across the product, infrastructure, and engineering culture by embedding security into the SDLC, leading application security efforts, managing vulnerabilities, and supporting incident response.

Responsibilities:

• You’ll work hands-on with engineering to embed security into fast-moving development workflows—helping us ship quickly without compromising trust, safety, or system integrity
• Embed security into every stage of the SDLC from design to deployment ensuring systems are secure by design, not patched later
• Lead secure code reviews across TypeScript/Node.js services and modern frontend stacks (React / Next.js / React Native)
• Partner with backend, frontend, SRE, and platform teams to proactively identify and mitigate risks in real-time systems, APIs, and payment flows
• Drive threat modeling for new features and systems, especially those involving transactions, integrations, and shared platform services
• Own the full vulnerability management lifecycle: discovery, triage, prioritization, remediation, and reporting
• Implement and scale security tooling (SAST, DAST, SCA, secrets scanning) integrated into CI/CD pipelines. Establish secure architecture patterns for high-scale, real-time systems and transaction processing
• Ensure auditability, data integrity, and traceability across critical systems
• Define and execute the application security strategy and roadmap aligned with rapid product iteration. Act as a trusted partner to engineering—balancing risk with speed in a high-velocity startup environment
• Build security guardrails that enable developers to move fast safely, not slow them down
• Help shape broader security initiatives including infrastructure security, governance, and risk management
• Support and lead security incident response, including root cause analysis and long-term remediation. Continuously improve security posture through automation, tooling, and developer education

Requirements:

• 8+ years of experience in Application Security, Security Engineering, or Software Engineering with a strong security focus
• Proven experience embedding security into modern SDLCs in fast-moving environments
• Strong hands-on background in secure coding and code review (ideally in TypeScript / Node.js ecosystems)
• Deep understanding of common vulnerabilities (e.g., OWASP Top 10) and modern attack vectors
• Experience with application security tooling (SAST, DAST, SCA) and integrating them into CI/CD pipelines
• Strong experience with threat modeling and designing secure, scalable architectures
• Familiarity with real-time, high-traffic systems, APIs, and distributed architectures
• Experience securing payments, transactions, or fintech-like systems (auditability, fraud considerations, traceability)
• Background in gaming, iGaming, or highly interactive real-time platforms
• Experience working across cloud and/or on-prem infrastructure alongside SRE / platform teams
• Familiarity with DevSecOps practices and security automation at scale
• Experience in early-stage or hypergrowth startups where speed and ownership are critical