Senior Security Engineer (Product Security)

Immutable is a leading game platform built to support studios at every stage of development and player engagement. Founded in 2018, the company rapidly achieved unicorn status with over AUD 400 million in funding and a valuation of AUD 3.5 billion. More than 700 games now build on Immutable's infrastructure, with major partners like Ubisoft choosing the platform for their gaming future. The company operates two core business lines: a marketing data platform that helps studios acquire and retain players, and blockchain infrastructure including an Ethereum layer-2 network and Passport, a player wallet for holding digital assets.

Immutable is in a period of rapid expansion, actively hiring talent to fuel continued growth. The company's newest product line, Immutable Audience, represents the fastest-growing SaaS offering in company history.

You'll join a five-person security team as a Senior Security Engineer focused on product security, reporting to the Head of Security. Your work will span web applications and APIs built on AWS and GCP, plus smart contract security where vulnerabilities carry direct financial impact. You'll spend most of your time embedded with product engineering teams, conducting code reviews, developing threat models collaboratively, and remediating issues before they reach production. The team targets fixing 80 percent of vulnerabilities before deployment, and this role is essential to achieving that goal.

What you'll do

• Manage the vulnerability management program end-to-end, including Bugcrowd and Immunefi bug bounties, scanning tool findings, and internal security assessments, maintaining 90-plus percent SLA compliance on critical and high-severity issues

• Develop and maintain AI agents that scan pull requests for security problems and triage incoming vulnerability reports with minimal manual overhead

• Build a security context layer combining threat models, asset inventory, and historical findings that enables AI systems to triage bugs and suggest fixes more effectively

• Keep threat models and attack graphs current as the product evolves and new services are added

• Conduct application security reviews identifying broken authentication flows, injection vulnerabilities, and other flaws, then work with engineers to implement proper fixes

What you'll bring

• Deep application security expertise and strong software engineering skills, able to ship production code for fixes or security tooling in addition to reviewing others' work

• Hands-on experience building AI tooling such as agents, automation systems, or internal tools, with clear thinking about what worked and what didn't

• Solid AWS security fundamentals covering IAM, network controls, secrets management, and misconfiguration detection

• Comfort with autonomy, strong collaboration skills with engineers, and willingness to support other security functions in a small team environment

• Preference for hands-on remediation work over pure vulnerability reporting

Nice to have

• Web3 security experience including wallet, smart contract, or dApp security

• Detection and response expertise or demonstrated interest in growing that skillset

• Previous experience running a bug bounty program or managing a findings pipeline end-to-end

What they offer

• Competitive global base salary plus contributions to a long-term fund, and employee stock options

• Hybrid working model for Sydney-based employees with three days weekly in the CBD office; remote employees receive WeWork All-Access passes and USD 500 annual work-from-home allowance

• USD 1,350 annually for professional development including courses, AI tools, and events, plus Udemy access

• USD 800 per year for health and wellbeing, 24/7 unlimited counseling for employees and family, ClassPass membership with one year free access to Breethe

• Paid parental leave, two additional paid annual leave days, and a paid birthday day off