Senior Staff Security Engineer

Fanatics is a global digital sports platform spanning commerce, collectibles, and betting and gaming. The Senior Staff Security Engineer will lead secure architecture, application and AI/ML security, threat modeling, security tooling, and organization-wide security programs while serving as a technical escalation point and mentoring engineering teams.

Responsibilities:

• Set the secure architecture strategy across product and enterprise environments, including on-premises, cloud, and containerless environments, establishing patterns and guardrails that other engineers and security teams build on, with a primary focus on application security and AI/ML system security
• Lead threat model reviews for the most complex services and AI systems, including LLM-integrated products, agentic workflows, and model supply chains. (Be an Enabler)
• Define and evolve the org's approach to AI security, securing model pipelines, data and trust boundaries, third-party model integrations, and AI attack surfaces
• Contribute production code to product features and internal security tooling as a hands-on engineering partner
• Act as the technical escalation point across security domains, including AppSec, cloud, identity, CI/CD, and AI, providing efficient security input across multiple product teams and architecture reviews simultaneously
• Drive and scale security coding programs supporting immutable, version-controlled environments through infrastructure as code, detection as code, and other engineering security initiatives
• Mentor senior and staff level engineers, raising the security engineering bar across the organization
• Represent security in cross-functional and executive level architecture discussions, translating technical risk into business impact
• Participate in an on-call rotation to provide 24/7 support for incident escalations, serving as an escalation lead for the most complex incidents

Requirements:

• 12+ years of experience in security engineering or a related field, including 6+ years of hands-on software engineering experience
• Strong proficiency developing and reviewing code in one or more programming languages, including Python, Java, or Go
• Deep expertise in application security, including secure SDLC integration, SAST/DAST/IAST tooling, manual code review, and API security
• Demonstrated experience securing AI systems, including LLM application security, prompt injection defenses, data governance, secure agentic tool use, and emerging AI-specific threats
• Demonstrated expertise implementing AWS security services and best practices (CloudTrail, GuardDuty, CloudWatch, Security Hub) at scale across multi-account environments
• Hands-on experience managing WAF platforms (Cloudflare, Akamai, Fastly, AWS WAF or equivalent), including custom rule development, not just enabling managed rulesets
• Demonstrated experience leveraging infrastructure as code with tools such as Terraform or Ansible, including designing secure module patterns and policy-as-code guardrails
• Experience with identity management protocols (OAuth, SAML, OpenID Connect) and designing identity architecture across multiple business units or products
• Deep understanding of secure CI/CD pipeline design, able to define what a good release pipeline looks like, why each stage exists, and how to harden against supply chain and pipeline compromise
• Track record of influencing security strategy and roadmap at an organizational level, not just executing within a single team
• Relevant certifications such as OSCP, OSWE, OSCE, or CISSP