About exmox

This is a company built for growth.

When you join exmox, you’re stepping onto a global, highly competitive playing field, solving real problems in environments that push you beyond your comfort zone. We move fast, cut the noise, and focus on what actually matters because, in our industry, speed wins.

With 50M+ platform downloads, we’re rapidly scaling one of the most exciting innovations in mobile gaming: a rewarded user engagement and acquisition platform that helps players discover and engage with games they enjoy, creating lasting value for both players and gaming studios.

exmox pays out real money to real users, and that shapes our security posture. As a Senior Security Engineer, Anti-Abuse (f/m/x), you’ll be our first dedicated security hire, sitting within the Platform Engineering team and owning the security vertical end to end in a cloud-native AWS environment running at scale.

This isn’t an advisory or reactive role. You’ll design, prototype, and incubate the defenses that protect our payout ecosystem against cross-cutting abuse. You’ll also define how we handle a threat surface that AI is widening on both sides: cheap, adaptive attack tooling and the trust model around the AI coding agents in our own development workflow.

If you’re excited by complex systems, high traffic, data-driven decisions, and the opportunity to grow by solving challenging problems, we want to hear from you.

Position: Senior Security Engineer, Anti-Abuse (f/m/x)

What You’ll Own

• Application Security: Secure design and code reviews across GraphQL, Python, and Go services. Identify logic flaws, broken trust boundaries, and authorization gaps. Conduct threat modeling with product teams during refinement, not after.
• Offensive Testing: Perform hands-on testing of our own authentication, session, and payout flows before releases and external security assessments, rather than waiting for issues to be discovered afterward.
• Abuse & Fraud Prevention: Defend against bots, credential stuffing, account takeovers, multi-accounting, and payout fraud. Work alongside our fraud team on per-account controls, step-up verification, and device and session signals.
• Edge Defense: Own AWS WAF end to end, including managed and custom rule groups, rate-based rules, bot mitigation, and continuous tuning. Manage CloudFront, origin protection, and DDoS posture as we move toward a multi-region edge.
• Detection & Response: Turn our comprehensive WAF logging and strong Datadog coverage into actionable security detections. Lead security incidents through technical response, postmortems, and follow-up actions.
• Security in the SDLC & Cloud: Build CI gates that developers actually use, covering secret detection, dependency and container scanning, and SBOM. Implement secure defaults in shared Helm and Terraform modules, and deliver cloud and Kubernetes controls as code.
• Compliance & Assurance: Coordinate external penetration testing and drive remediation. Own ISO 27001 readiness and GDPR-related engineering as an engineering problem by mapping controls to existing processes and automating evidence collection.

What You Bring

• Engineering Background: You write code, ideally in Python and TypeScript (Go is a plus), and can read an unfamiliar service to identify logic flaws that automated scanners won’t catch.
• Application Security Expertise: You understand authentication and session design, authorization and trust boundaries, API and GraphQL security, injection vulnerabilities, and secrets management. You’ve fixed these issues yourself, not just reported them, and validate security controls by testing their resilience.
• Adversarial Traffic Experience: You have hands-on experience with bot mitigation, credential stuffing, account takeover, rate limiting at scale, or fraud prevention in an environment where someone is actively working against you. You understand where attacks create value for attackers and how to design controls that make them economically unattractive.
• AWS WAF & Detection Engineering: You’ve written and tuned custom WAF rules, handled false positives affecting real users, and can turn raw logs into actionable alerts using SQL/Athena or equivalent tools and Datadog or comparable platforms.
• AWS & Kubernetes: You’re experienced enough to implement security controls yourself using Terraform and confidently contribute to Platform design reviews.
• Influence & Ownership: You can write design documents developers actually read, disagree constructively, and explain risks to leadership in financial terms. You’ve handled incidents with real customer impact and are comfortable being the only security specialist, prioritizing initiatives and confidently saying “not yet” when necessary.

Nice-to-Have Skills

• Experience implementing ISO 27001 or SOC 2 requirements.
• Background in marketplaces, fintech, gaming, or ad-tech, with mobile attribution experience being a bonus.
• Knowledge of policy-as-code tools such as Kyverno or OPA.
• Relevant certifications such as AWS Security Specialty, CKS, or OSCP.

Our Tech Stack

Our technology stack includes:

• Cloud & Infrastructure: AWS, Kubernetes (K8s), Terraform.
• Development & CI/CD: GitLab CI.
• Programming Languages & Frameworks: Python (FastAPI), Go, TypeScript, Nuxt, and Flutter.
• APIs & Architecture: Apollo Federation GraphQL.
• Monitoring & Analytics: Datadog and Databricks.
• Security & Verification: Biometric liveness verification.

How We Win

• Speed Is the Feature: Speed beats rocket science. We move fast, test fast, and multiply our pace with AI because action creates information and small wins compound. A fast failure is a lesson we learn from; a slow one is a problem we can’t afford.
• Focus on the Essential: Done is better than perfect. We stay focused on what actually moves us forward and protect people’s time from anything that doesn’t. We’re direct in how we communicate, too: no rambling and no unnecessary detail.
• See It. Own It. Solve It.: The first person to see a problem is best placed to fix it. We’re not a place for comfort; we’re a place for doers. “Not my job” isn’t in our vocabulary. If you spot something, you help make sure it gets solved.
• Respect Others. Trust Multiplies.: Respect is non-negotiable. We disagree with ideas, never with people. Trust is built through consistency, a simple thank you, a moment of listening, and taking responsibility for our mistakes.

What We Offer

We provide perks that help you focus on what matters, including:

• Transport Subsidy: Support for your daily commute.
• Learning Budget: Invest in your professional and personal development.
• Wellness & Gym: Benefits that support your health and well-being.
• Workation: Opportunities to combine work and travel.
• Team Lunches: Bi-weekly team lunches to connect and collaborate.
• And More: Additional perks designed to make your working experience enjoyable.

The perks are great, but the real reason people join and stay is the challenge, the ownership, and the drive to win together.

Working Model & Location

Please note: This is not a fully remote position. We offer a flexible hybrid working model based in Hamburg, Germany:

• Monday & Friday: Work from home.
• Tuesday, Wednesday & Thursday: Work from our office in Hamburg.