Senior Security Engineer

About the role

The Mill Adventure is building a modern, event‑driven gaming platform and needs a senior security professional to own the product and cloud security posture. You will work hands‑on, designing and implementing security controls while collaborating closely with developers and architects.

Key responsibilities

• Architect, implement and maintain security controls across AWS, Cloudflare, applications and CI/CD pipelines.
• Coach developers and engineers on secure design, threat modelling and cloud security best practices.
• Own vulnerability and attack‑surface management, prioritising real exploitability and driving remediation.
• Integrate, tune and maintain SAST, DAST and SCA tools to keep security friction low for developers.
• Engineer the cloud security posture: harden configurations, automate compliance checks and monitor IAM policies.
• Design detection and response processes, tune alerts, investigate incidents and produce post‑incident reviews.
• Apply offensive security techniques to validate controls and guide remediation priorities.
• Leverage AI‑driven tooling to automate triage, code review, detection engineering and evidence collection.

Required profile

• 5+ years of hands‑on security engineering experience with end‑to‑end ownership of solutions.
• Proven ability to design, build and ship security architectures that survive peer review.
• Strong judgement across security engineering, operations and offensive security, with a focus on automation.
• Deep expertise in AWS security services (IAM, Organizations, SCPs, Security Hub, GuardDuty, WAF) and Cloudflare.
• Experience running vulnerability and attack‑surface management programs and influencing other teams to close findings.
• Solid understanding of SIEM, detection engineering and incident response processes.
• Practical offensive knowledge to turn misconfigurations into realistic attack paths.
• Hands‑on experience with AI tools applied to security workflows.

Required skills

• AWS security services (IAM, Organizations, SCPs, Security Hub, GuardDuty, WAF)
• Cloudflare configuration and security features
• Programming/scripting: Python, Go, Bash (TypeScript a plus)
• Infrastructure as Code (IaC) concepts and tools
• CI/CD pipeline security (SAST, DAST, SCA)
• Vulnerability management and attack‑surface analysis
• SIEM platforms and detection rule development
• Offensive security techniques and threat modelling
• AI‑assisted security automation