Note: The job is a remote job and is open to candidates in USA. Fanatics is a global digital sports platform spanning commerce, collectibles, and betting and gaming. The Senior Staff Security Engineer will lead secure architecture, application and AI/ML security, threat modeling, security tooling, and organization-wide security programs while serving as a technical escalation point and mentoring engineering teams.
Responsibilities
- Set the secure architecture strategy across product and enterprise environments, including on-premises, cloud, and containerless environments, establishing patterns and guardrails that other engineers and security teams build on, with a primary focus on application security and AI/ML system security
- Lead threat model reviews for the most complex services and AI systems, including LLM-integrated products, agentic workflows, and model supply chains. (Be an Enabler)
- Define and evolve the org's approach to AI security, securing model pipelines, data and trust boundaries, third-party model integrations, and AI attack surfaces
- Contribute production code to product features and internal security tooling as a hands-on engineering partner
- Act as the technical escalation point across security domains, including AppSec, cloud, identity, CI/CD, and AI, providing efficient security input across multiple product teams and architecture reviews simultaneously
- Drive and scale security coding programs supporting immutable, version-controlled environments through infrastructure as code, detection as code, and other engineering security initiatives
- Mentor senior and staff level engineers, raising the security engineering bar across the organization
- Represent security in cross-functional and executive level architecture discussions, translating technical risk into business impact
- Participate in an on-call rotation to provide 24/7 support for incident escalations, serving as an escalation lead for the most complex incidents
Skills
- 12+ years of experience in security engineering or a related field, including 6+ years of hands-on software engineering experience
- Strong proficiency developing and reviewing code in one or more programming languages, including Python, Java, or Go
- Deep expertise in application security, including secure SDLC integration, SAST/DAST/IAST tooling, manual code review, and API security
- Demonstrated experience securing AI systems, including LLM application security, prompt injection defenses, data governance, secure agentic tool use, and emerging AI-specific threats
- Demonstrated expertise implementing AWS security services and best practices (CloudTrail, GuardDuty, CloudWatch, Security Hub) at scale across multi-account environments
- Hands-on experience managing WAF platforms (Cloudflare, Akamai, Fastly, AWS WAF or equivalent), including custom rule development, not just enabling managed rulesets
- Demonstrated experience leveraging infrastructure as code with tools such as Terraform or Ansible, including designing secure module patterns and policy-as-code guardrails
- Experience with identity management protocols (OAuth, SAML, OpenID Connect) and designing identity architecture across multiple business units or products
- Deep understanding of secure CI/CD pipeline design, able to define what a good release pipeline looks like, why each stage exists, and how to harden against supply chain and pipeline compromise
- Track record of influencing security strategy and roadmap at an organizational level, not just executing within a single team
- Relevant certifications such as OSCP, OSWE, OSCE, or CISSP
Company Overview
Company H1B Sponsorship