Note: The job is a remote job and is open to candidates in USA. SpinQuest is building a high-growth social gaming platform with innovative currency mechanics and scalable, real-time gaming experiences. The Staff Engineer - Security will shape security across the product, infrastructure, and engineering culture by embedding security into the SDLC, leading application security efforts, managing vulnerabilities, and supporting incident response.
Responsibilities
- You’ll work hands-on with engineering to embed security into fast-moving development workflows—helping us ship quickly without compromising trust, safety, or system integrity
- Embed security into every stage of the SDLC from design to deployment ensuring systems are secure by design, not patched later
- Lead secure code reviews across TypeScript/Node.js services and modern frontend stacks (React / Next.js / React Native)
- Partner with backend, frontend, SRE, and platform teams to proactively identify and mitigate risks in real-time systems, APIs, and payment flows
- Drive threat modeling for new features and systems, especially those involving transactions, integrations, and shared platform services
- Own the full vulnerability management lifecycle: discovery, triage, prioritization, remediation, and reporting
- Implement and scale security tooling (SAST, DAST, SCA, secrets scanning) integrated into CI/CD pipelines. Establish secure architecture patterns for high-scale, real-time systems and transaction processing
- Ensure auditability, data integrity, and traceability across critical systems
- Define and execute the application security strategy and roadmap aligned with rapid product iteration. Act as a trusted partner to engineering—balancing risk with speed in a high-velocity startup environment
- Build security guardrails that enable developers to move fast safely, not slow them down
- Help shape broader security initiatives including infrastructure security, governance, and risk management
- Support and lead security incident response, including root cause analysis and long-term remediation. Continuously improve security posture through automation, tooling, and developer education
Skills
- 8+ years of experience in Application Security, Security Engineering, or Software Engineering with a strong security focus
- Proven experience embedding security into modern SDLCs in fast-moving environments
- Strong hands-on background in secure coding and code review (ideally in TypeScript / Node.js ecosystems)
- Deep understanding of common vulnerabilities (e.g., OWASP Top 10) and modern attack vectors
- Experience with application security tooling (SAST, DAST, SCA) and integrating them into CI/CD pipelines
- Strong experience with threat modeling and designing secure, scalable architectures
- Familiarity with real-time, high-traffic systems, APIs, and distributed architectures
- Experience securing payments, transactions, or fintech-like systems (auditability, fraud considerations, traceability)
- Background in gaming, iGaming, or highly interactive real-time platforms
- Experience working across cloud and/or on-prem infrastructure alongside SRE / platform teams
- Familiarity with DevSecOps practices and security automation at scale
- Experience in early-stage or hypergrowth startups where speed and ownership are critical
Benefits
- Remote work arrangement
Company Overview