Platform Security Engineer

About the role

The Platform Security Engineer will protect large‑scale digital products used by a global audience. Based in Saudi Arabia, you will work across engineering, infrastructure and security teams to strengthen platform defenses, safeguard customer data and address emerging threats.

Key responsibilities

• Maintain perimeter and network security controls, including WAF, rate limiting, anti‑bot and DDoS mitigation.
• Secure APIs against abuse and common vulnerabilities, improving authentication, authorization and access controls.
• Lead the vulnerability management lifecycle: identify, prioritize, track and validate remediation.
• Coordinate external penetration‑testing engagements and ensure timely resolution of findings.
• Drive incident‑response activities for product security events and enhance detection capabilities.
• Partner with cross‑functional teams on fraud prevention, trust & safety, and customer data protection (encryption, masking, secure access).
• Promote secure development practices through Security Champions and Bug Bounty programs.

Required profile

• Minimum 5 years of information‑security experience, with at least 3 years focused on product security.
• Hands‑on expertise with Web Application Firewalls such as Wallarm, Akamai or Cloudflare.
• Strong understanding of API security principles (OWASP API Security Top 10) and API‑gateway technologies.
• Experience implementing anti‑bot solutions using behavioral analysis and fingerprinting.
• Practical knowledge of DDoS protection across Layers 3‑7.
• Experience managing vulnerability‑management programs, CVSS scoring and remediation tracking.
• Familiarity with coordinating penetration‑testing engagements and interpreting assessment reports.

Required skills

• Web Application Firewall (Wallarm, Akamai, Cloudflare)
• API security, OWASP API Security Top 10, API gateways
• Anti‑bot solutions (behavioral analysis, fingerprinting)
• DDoS mitigation (Layers 3‑7)
• Vulnerability management, CVSS scoring
• Penetration‑testing coordination
• OAuth, OpenID Connect, JWT, session management
• SQL, Elasticsearch for security investigations