Infrastructure Security Engineer

About The Role We are looking for an Infrastructure Security Engineer to own the security of the Booming Games platform: the Linux hosts and containers that serve our games, the MongoDB data layer and the network edge our operator partners connect to. This is a hands-on role. You will write the security protocols, implement them on the infrastructure, keep them running and update them as threats and regulatory requirements evolve. You will choose and operate the tooling, run the vulnerability and patch cycle, and be the first responder when something looks wrong. You report directly to the CTO and work with the Systems and Infrastructure team, platform engineers and Technical Compliance (owners of the ISMS and ISO 27001). Responsibilities Security Protocols & StandardsOwn the full lifecycle of Booming Games' technical security protocols: write them, implement them, maintain them and update them on a defined review cadenceDefine hardening baselines for Linux hosts, Docker images and containers, MongoDB clusters and network devices, and enforce them across production, staging and developmentMaintain operational runbooks for patching, access provisioning and revocation, key and certificate rotation, backup verification and incident handlingTranslate ISO 27001 controls and regulator technical standards into concrete, testable configuration, working with Technical Compliance on evidence and audit readinessReview and approve security-relevant changes to infrastructure and platform architecture before they reach productionInfrastructure & Platform HardeningHarden the Linux server estate: SSH policy, privilege management, kernel and package patching, host firewalls, file integrity and audit loggingSecure the container platform: minimal base images, image scanning in the build pipeline, registry controls, runtime restrictions, secrets injection and least-privilege service accountsOwn MongoDB security: authentication and role-based access, TLS between nodes and clients, encryption at rest, audit logging, backup encryption and restore testingManage secrets, keys and certificates centrally, with documented ownership, rotation schedules and no credentials in code or imagesReduce the attack surface of game servers and platform services through segmentation, exposure reviews and removal of unused services and portsNetwork SecurityDesign and maintain network segmentation between public-facing game delivery, internal platform services, databases and management accessOperate the edge: firewall rules, WAF and CDN policies, rate limiting, DDoS mitigation and TLS configuration for all external endpointsControl partner and aggregator connectivity: IP allow-listing, mutual TLS or VPN where required, and reviewed exposure of every integration endpointSecure remote and administrative access through VPN, bastion hosts, MFA and session loggingMaintain accurate network diagrams and an inventory of every internet-facing assetSecurity Tooling, Monitoring & DetectionSelect, deploy and operate the security toolset: centralised logging and SIEM, intrusion detection, vulnerability scanning, endpoint protection and secrets scanningBuild alerting that detects unauthorised access, privilege escalation, anomalous database queries, configuration drift and abnormal traffic to game endpointsTune detection to reduce noise so that alerts are acted on, and define escalation paths and on-call expectations for security eventsRun the vulnerability and patch management cycle end to end: scan, prioritise by exploitability and exposure, remediate, verify and reportTrack security metrics (patch latency, open findings by severity, mean time to detect and respond) and report them to the CTO monthlyIncident Detection & ResponseAct as first technical responder for suspected security incidents: contain, preserve evidence, investigate root cause and coordinate remediationOwn the incident response plan and run at least one tabletop or live exercise per year against a realistic platform compromise scenarioProduce post-incident reports with timeline, impact, root cause and corrective actions, and drive those actions to closureSupport Legal, Compliance and Commercial with the technical facts needed for regulator, partner and operator notificationsCoordinate with external forensic or penetration testing providers when engagedAssurance, Audit & AwarenessProvide the technical input for ISO 27001 audits, certification lab reviews and regulator security submissions, and remediate findingsComplete operator and aggregator security questionnaires and due diligence requests accurately and on timeCommission and manage annual penetration tests, triage results and track remediationReview third-party services and vendors with access to infrastructure or data before onboardingRun practical security awareness for engineering and operations staff, and embed secure configuration checks into deployment pipelines Requirements 4+ years of hands-on experience in security engineering, DevSecOps or infrastructure security, with demonstrable ownership of a production environment's securityStrong Linux administration and hardening skills (Debian or RHEL family): users and privileges, SSH, firewalls, systemd, auditd, log management and patchingSolid MongoDB security knowledge: authentication and RBAC, TLS, encryption at rest, replica set security, auditing and backup protectionDocker and container security in production: image build hygiene, scanning, registries, runtime hardening and secrets handlingStrong networking fundamentals: TCP/IP, DNS, TLS, routing, firewalls, VPNs, load balancers, segmentation and WAF/CDN configurationExperience selecting and operating security tooling: SIEM or log analytics, IDS/IPS, vulnerability scanners, endpoint protection and secrets managementScripting and automation in Bash and Python (or equivalent), with the ability to automate checks, remediation and reportingExperience writing security protocols and runbooks that engineers actually follow, and the discipline to keep them currentIncident response experience on live systems, including evidence handling and root cause analysisWorking knowledge of ISO 27001 controls and how they map to technical implementationClear written and verbal communication, able to explain risk and required actions to engineers, management and external auditors Nice to have Experience in online gambling or iGaming, ideally on the supplier side: RGS platforms, game servers and operator integrationsFamiliarity with regulator and certification technical security standards such as ISO 27001, MGA and UKGC security requirements, GLI-19 and GLI-33, and experience working with test labs such as GLI, eCOGRA or iTech LabsKubernetes security and infrastructure-as-code tooling (Terraform, Ansible) with policy-as-code or IaC scanningExperience with both public cloud and bare-metal or co-located hostingPenetration testing or offensive security backgroundProfessional certification such as OSCP, CISSP, CCSP, GIAC or CompTIA Security+ Good to know We embrace diversity and equal employment opportunities. We are committed to creating a fair, supportive, and open environment for all.Please understand that we can only consider applicants who are located in the European time zone. (+/- 2 hours). All other applications will be automatically deleted due to the high volume of applicants. Why Work for Booming Games Founder led. Impact driven. Employee centric. At Booming Games, we're reshaping the iGaming world with our remote-first approach. Our rhythm? Thrilling slot games with captivating features and stunning designs released every two weeks - no exceptions! Here, it's all about co-ownership and real growth. Dive into a diverse team where your input powers every game we craft! Our perks Competitive base salary with performance-linked bonusFlexible and/or hybrid working arrangementsOwnership of the security function for a live, high-traffic gaming platform, reporting directly to the CTOReal budget and autonomy to choose and implement the tooling you needInternational regulatory exposure across multiple licensed jurisdictionsClear career pathway toward Head of Security or CISO as the function grows Contact HR Team About Us BOOMING GAMES has evolved from a shared vision into a leading slot provider, delivering exhilarating mobile and web-based games. Our drive for innovation shapes an extraordinary gaming experience featuring top-notch gameplay, stunning graphics, and a steadfast commitment to fair and responsible gaming. Join us on this thrilling adventure, where each game we create is not just a product but a captivating journey blending cutting-edge technology with boundless excitement.