Principal Product Security Engineer

The Leaflet

Principal Product Security Engineer ensuring application security across all products of Hard Rock Bet. Overseeing vulnerability management and collaborating with engineering and product teams.

Posted 7/9/2026full-timeRemote • Florida • 🇺🇸 United StatesLeadWebsite

Tech Stack

Tools & technologies

AWSCloudSDLC

About the role

Key responsibilities & impact

Secure SDLC & DevSecOps
Embed automated checks across our cloud (GitHub Actions) and on-prem product pipelines — GitHub Advanced Security (SAST/SCA) and Wiz Code for application, dependency, and container scanning
Define secure-by-default patterns, paved-road guardrails, and standards for secure coding, code review, and dependency hygiene — so teams ship quickly and safely
Serve as the application authority for our Zero Trust program, aligned to NIST SP 800-207 and the CISA Zero Trust Maturity Model (Applications & Workloads pillar)
Threat Modeling & Secure Design
Partner with product and engineering on security reviews for new features and payment integrations — running threat modeling (e.g., STRIDE) early in design and turning output into concrete, prioritized work
Vulnerability Management (End to End)
Own the product and application vulnerability lifecycle — one program spanning code, dependency, container, pen-test, and bug-bounty findings, from discovery through remediation
Prioritize by real-world risk and drive remediation against risk-based SLAs; engineering owns the fixes, you own the program and the escalation paths that shrink time to remediate
Report program health with metrics leadership can act on, and provide evidence for compliance obligations (PCI DSS, GLI, ISO 27001, SOC 2)
Application & API Security
Defend our applications and APIs against the OWASP Top 10 and API abuse, partner on payment security across our payment gateways, and team with our Principal Cloud & Network Security Engineer — who owns our Cloudflare edge defenses (WAF, Bot Management) — on bot and abuse resilience
Own the application security of player-facing account flows — registration, authentication, session management, recovery — partnering with our Principal Identity Engineer on CIAM architecture and with SecOps and Fraud on account-takeover resilience
Testing & External Assurance
Coordinate penetration testing with external partners and drive findings to closure
Mature our existing coordinated-disclosure program into a full bug-bounty capability

Requirements

What you’ll need

10+ years in application or product security — or equivalent practical experience
Deep expertise across the AppSec toolchain: SAST, SCA, and secure code review
Strong command of the vulnerability management lifecycle: triage, prioritization, remediation tracking, metrics
Hands-on threat modeling and secure-design partnership with engineering teams
Working knowledge of a modern programming language and how real applications are built and deployed
Experience with CI/CD pipelines and cloud-native application security (our products run primarily on AWS)
Excellent communication — you turn a finding into a clear, prioritized ask
Fluency with AI — you lead with it, reaching for AI tools daily to work faster and sharper; hands-on experience applying AI to security or engineering work is a must.

Benefits

Comp & perks

Competitive pay and benefits
Flexible vacation allowance
A hybrid / remote working environment
Startup culture backed by a secure, global brand

ATS Keywords

✓ Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills & Tools

SASTSCASecure Code ReviewThreat ModelingVulnerability ManagementCloud-Native Application SecurityModern Programming LanguageAI Tools ApplicationMetrics ReportingCompliance Standards

Soft Skills

Excellent Communication

Certifications

PCI DSSGLIISO 27001SOC 2