Lead Application Security

Job Description:

About Fanatics Momentum

Fanatics Momentum is building the UAE's leading regulated commercial gaming operator. Licensed by the General Commercial Gaming Regulatory Authority (GCGRA), we operate across lottery, iGaming, sports book, and digital content, combining Momentum's regional foundation with Fanatics' global product, technology, and scale. The business is ambitious, well-resourced, and moving fast. If you want to help build a category-defining operator in one of the world's most exciting regulated gaming markets, this is the right time to join.

Overview

We're building a new UAE-based business spanning Sports book, Casino, Lottery and a broader connected Fan Ecosystem, backed by Fanatics and Momentum. As Lead, Application Security, you'll own application security testing and Dev Sec Ops  engineering end to end across Fan Mo's technology platforms.

Responsibilities What You’ll Own Application Security & Testing

• Own Fan Mo's application security testing capability across SAST, DAST, IAST, SCA, secrets detection, container scanning, infrastructure-as-code scanning, API security and mobile application testing.
• Manage the full lifecycle of application security platforms, including evaluation, implementation, integration, configuration, upgrades and ongoing optimization.
• Establish application onboarding, scanning policies, security rules and testing frequency based on application risk.
• Tune existing rulesets and develop custom rules to improve accuracy and reduce false positives.
• Build a consolidated view of application security risk, prioritizing findings based on exploitability and business impact.
• Extend application security testing to AI-generated code and AI-enabled product features.

Vulnerability Management & Developer Enablement

• Own vulnerability triage, validation, prioritization and remediation tracking across application security findings.
• Establish automated workflows to route findings to engineering teams, track remediation against agreed SLAs and verify closure.
• Build developer self-service capabilities, including IDE integrations, secure templates, approved base images and hardened libraries.
• Provide practical, actionable remediation guidance directly to developers.
• Establish and support a security champions network across engineering teams.
• Develop secure-by-default instructions, reusable rules and skills for AI coding assistants to ensure generated code aligns with organizational security standards.
• Deliver targeted secure-coding education based on recurring vulnerabilities and root-cause analysis.

Offensive-Informed Application Security

• Validate high and critical vulnerabilities through hands-on testing and proof-of-concept exploitation in non-production environments.
• Conduct manual security testing of high-risk features, APIs and business logic ahead of release.
• Translate confirmed exploits and penetration-testing findings into automated regression tests.
• Design abuse-case testing for gaming-specific risks, including bonus and promotion abuse, wallet and balance race conditions, bet manipulation, account takeover and responsible-gaming control bypasses.

Software Supply Chain Security

• Define and implement security controls for dependency management, artifact signing, provenance verification and Software Bill of Materials (SBOM) generation.
• Assess third-party libraries, components and build dependencies for security risk.
• Address AI-specific supply chain risks, including AI-suggested or non-existent packages, third-party models, MCP servers, plugins and IDE extensions.
• Monitor newly disclosed vulnerabilities in third-party components and drive prioritized remediation across affected applications.

Threat Modeling & Secure Software Delivery

• Establish repeatable threat-modeling…