Senior Security Engineer

Senior Security Engineer

The Mill Adventure is a scale-up with the ultimate mission of building awesome products that will change the way the iGaming industry operates. We started our journey in 2019 with the vision of building a technology-driven organization and creating a team consisting of the best of the best specialists in their respective fields.

Today, we provide a complete gaming platform for rapid deployment and success in iGaming. Our team of 100+ technology and iGaming experts is guided by a passion for invention, operational excellence and commitment to improving the inefficient.

We trust and value our team and strive to accommodate the right working conditions for each individual in remote, office-based or mixed models. We see the strength in being different and embracing the cultural diversity existing in our group.

One of our key strengths is our modern, event-driven, serverless technology stack, which allows us to innovate and move fast. We work in a collaborative environment that values both teamwork and autonomy.

The Role As a Senior Security Engineer, you will be the cornerstone of our product and cloud security posture. You will own security across the code, the cloud, the pipelines, the corporate estate, and the response when an alert comes in.

This is a hands-on role with real architectural ownership. You will design our security controls and then build them — our security team is small, and you will be one of three people, so there is nobody to hand a design to. That cuts both ways: almost nothing stands between a good idea and it being live, and there is nowhere to hide if it doesn't get delivered. If your recent work has been mostly programme management, vendor oversight or reviewing other people's designs, this won't be the right fit.

Much of the work will also happen through other people. Security can't do everything alone, so you will spend real time with developers and architects — reviewing designs, threat modelling, coaching on secure practices — and your impact will be measured as much by what they build securely as by what you build yourself.

The role spans security engineering, IT security, security operations and a degree of offensive security. Breadth matters less as a checklist than as judgement: knowing which risks are real, which findings are noise, what to fix first, and — most importantly — what to automate so it stays fixed without anyone watching it.

You will be doing this in 2026, which means AI sits on both sides of the board. Attackers move faster and cheaper than they did two years ago, and the only realistic way for three people to cover this surface is to build AI into how the team works. You should already be doing this, not planning to.

On how we work: we review each other's work openly, and designs get challenged on their merits. We think that produces better security, and we'd expect you to challenge ours in the same way.

What You'll Do:

• Architect and lead the design and implementation of security controls across our cloud infrastructure, applications and CI/CD pipelines — and build them yourself
• Coach and mentor developers, engineers and architects on secure design, threat modelling and cloud security, so that security scales beyond the security team and becomes part of how we build
• Own vulnerability management and our attack surface: know what is exposed, prioritise by real exploitability rather than scanner severity, and drive findings to closure with the teams that own them
• Own the security of the SDLC by integrating and tuning SAST, DAST and SCA so that developers keep them enabled because the signal is worth the friction
• Engineer and maintain our cloud security posture, primarily in AWS and Cloudflare — hardening configurations, automating compliance checks, and closing gaps before they are found for you
• Own detection and response end to end: shape what we log and alert on, tune out the noise, investigate what is real, remediate it, and write up what happened
• Architect and guide our IAM strategy, working with engineering to deliver least-privilege access for human and machine identities that teams don't route around
• Test our own systems. Use offensive techniques against our infrastructure, applications and identity flows to validate that controls work and to decide what actually gets fixed first
• Use AI as a force multiplier for a team that is small relative to its surface — agentic tooling for triage, code review, detection engineering, evidence collection and the automation of toil. You will also be the person who secures AI systems as we adopt them
• Automate everything. If you would otherwise do it twice, automate it
• Bring us the uncomfortable assessments — with a plan and a first PR attached