Security Engineer, Application Security

About Game Changer:

We believe in the life changing impact youth sports have on and off the field. Sports encourage leadership, teamwork, responsibility, and confidence – important life lessons that have the power to propel our youth toward meaningful futures. We recognize that without coaches, parents, and volunteers, organized youth sports could not exist. By building the first and best place to experience the youth sports moments important to our community, we are helping families elevate the next generation through youth sports.

So if you love sports and their community building potential, or building cool products is your sport, Game Changer is the team for you. We are a remote first, dynamic tech company based in New York City, and we are solving some of the biggest challenges in youth sports today.

We’re looking for a Security Engineer to join our Info Sec team and become the primary security partner for our software engineering organization. Reporting to the Security Engineering Manager, you’ll operate application security across the SDLC, champion secure design and development practices, and bring Dev Sec Ops  discipline to how we build and ship software. This is a high-impact, highly collaborative role.

You’ll work closely with platform and product engineers to make security a part of how we build and deliver. You will also be a member of our weekly on-call rotation.

• Embed security into every phase of the SDLC
• Champion security requirements for the responsible and secure integration of Gen AI and agentic AI tools within our product stack
• Conduct security-by-design engagements for new features, APIs, platform initiatives, and infrastructure changes
• Perform secure code reviews providing engineers with clear, actionable findings and remediation guidance
• Partner with architecture and platform teams to establish secure API patterns (REST and GraphQL)
• Contribute to and maintain secure coding guidelines, API security standards, and security architectural patterns that serve as the “paved roads” for all engineering teams
• Give useful code review feedback, write documentation that outlasts the ticket, and run the occasional workshop or lunch-and-learn for engineers

• Integrate and maintain security tooling across CI/CD pipelines
• Enforce security quality gates in delivery pipelines
• Harden the CI/CD platform components, including configuration and hardening of Git Hub Actions and runner environments
• Identify opportunities to leverage AI for increasing engineering productivity and agentic security workflows
• Work alongside Dev Ops engineers to ensure cloud infrastructure is defined and deployed securely via IaC (terraform, k8s)
• Implement and validate security controls for containerized workloads
• Support the implementation of application-layer network security controls, such as Web Application Firewalls (WAFs) and CDN security, to protect application endpoints

• Operate the application vulnerability management lifecycle
• Triage and prioritize findings from our sources (including; GHAS, Now Secure, Wiz, Bug Crowd, penetration tests) by business impact and exploitability
• Proactively identify systemic risks and facilitate cross-functional initiatives to address root causes
• Track security-specific KPIs (e.g., MTTR, vulnerability density, and security coverage of CI/CD pipelines) and translate them into actionable insights for engineering and business leadership
• Effectively communicate security risk clearly to both engineering and business leaders

• 3+ years in application security engineering
• Proven experience building and operating internal security developer platforms or tooling that reduces developer friction
• Demonstrated ability to use AI/ML-driven tools to enhance security effectiveness and scalability
• Hands-on experience leading threat modeling engagements and designing paved roads
• Proven track record integrating security tooling into CI/CD pipelines
• Working knowledge of OWASP Top 10s (web, mobile, API, LLM)
• Hands-on experience securing deployments in AWS with container and Kubernetes security, IaC scanning, and…