Security Engineer

Xsolla is seeking a Security Engineer to join their new security team during a critical build-out phase. This role involves working across application security and infrastructure security, reviewing code, hardening cloud environments, supporting incident response, and partnering with engineering teams to improve the company's security posture. This is a generalist role suitable for an early-team hire, comfortable working across domains and growing expertise as the team matures. You will collaborate closely with the security program manager and engineering teams.

Xsolla is a global commerce company that helps developers launch, grow, and monetize video games. Headquartered in Los Angeles, California, Xsolla supports studios of all sizes with solutions for direct-to-consumer commerce, intelligent payments, IP, and player engagement. Trusted by over 60% of the top 100 highest-grossing games, Xsolla operates as the merchant of record in over 200 geographies with access to over 1,000 local payment methods.

If you are passionate about game development and possess a strong understanding of security principles, we encourage you to apply and help shape the future of game commerce security.

Company Overview

Xsolla is a global commerce company with robust tools and services designed to help developers overcome the challenges of the video game industry. Whether indie or AAA, companies partner with Xsolla to fund, distribute, market, and monetize their games. With a belief in the future of video games, Xsolla is dedicated to creating opportunities and providing new resources for creators. Headquartered and incorporated in Los Angeles, California, Xsolla acts as the merchant of record, assisting over 1,500 game developers worldwide in reaching more players and expanding their businesses. Xsolla provides developers with the necessary resources to thrive in the gaming market.

Quick Details

• Salary Range: Not Applicable
• Job Type: Full-time
• Experience: Not Specified
• Qualifications: Not Specified

Key Responsibilities

• Perform Application Security Reviews, including code reviews and SAST/DAST/dependency scanning.
• Participate in Threat Modeling for new features and architecture changes.
• Harden Cloud and Container Infrastructure, focusing on GCP, Kubernetes, and IAM configurations.
• Participate in Pen Test Remediation by triaging findings and coordinating fixes with engineering teams.
• Partner with Engineering on Secure Design, advising on secure implementation patterns.
• Identify and Track Security Findings throughout the remediation lifecycle.
• Support Incident Response by investigating security events and contributing to root-cause analysis.
• Write Async Security Guidance, advisories, and best-practice documentation.
• Support Product Security by contributing to reviews and assessments of customer-facing services.

Requirements

• Foundational AppSec knowledge, including common vulnerability classes and secure coding patterns.
• Exposure to cloud environments like GCP, with familiarity in IAM, networking, and container concepts.
• Code literacy in Go, Python, or PHP, with the ability to follow logic and spot issues.
• Familiarity with security tooling such as SAST, DAST, or dependency scanning tools.
• Strong written communication skills for clear async documentation across time zones.
• Collaborative mindset, focusing on helping engineering teams build securely.
• Self-directed with a growth mindset, comfortable with ambiguity and learning new technologies.

Benefits

• Opportunity to join a new security team during a critical build-out phase.
• Work across application security and infrastructure security domains.
• Collaborate with engineering teams to improve the company's overall security posture.
• Grow expertise in a generalist role within a maturing security program.
• Contribute to a global commerce company at the forefront of the video game industry.