SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Immutable is a fast-growing game platform founded in 2018, now a unicorn valued at AUD $3.5B. The company powers game creation and growth through a full-stack product suite, including a marketing data platform for studios, blockchain infrastructure (Ethereum layer-2 network), and Passport (a player wallet for digital assets). Over 700 games build on Immutable, with partners like Ubisoft.
You'll join a five-person security team reporting to the Head of Security. This role focuses on product security across web apps, APIs, AWS, GCP, and smart contracts. You'll spend most of your time embedded with product engineering teams, reviewing new services, building threat models collaboratively, and fixing vulnerabilities in their code. The team targets fixing 80% of vulnerabilities before production reaches users.
Key responsibilities:
- Own the vulnerability management program, including Bugcrowd and Immunefi bug bounties, with a goal of 90%+ SLA compliance on critical and high issues
- Own AI agents that review pull requests for security issues and triage incoming bugs
- Build a security context layer (threat models, asset inventory, past findings) to enable agents to triage and propose fixes with less human input
- Keep threat models and attack graphs current as the product evolves
You'll have autonomy, work closely with engineers, and help across other security areas as needed in a small team environment.
REQUIREMENTS:
- Application security depth: ability to identify broken auth flows and injection bugs, explain root causes, and fix them properly. Must be a capable software engineer who ships production code.
- Experience building AI tooling (agents, automation, or internal tools). Must have hands-on experience building, not just using, AI tools.
- Solid AWS security experience (IAM, network controls, secrets, misconfigurations).
- GCP, detection and response experience, and web3 knowledge are useful but not required.
- Preference for autonomy, ability to work well with engineers, willingness to help across security functions.
- Bonus: Web3 experience (wallet, smart contract, dApp security); detection and response expertise or interest in growing into it; experience running bug bounty programs or findings pipelines end-to-end.
