Overview
Join to apply for the Product Security Architect role at Flutter Entertainment.
Location – Leeds/Dublin. Hybrid - 2 days per week.
Flutter is seeking a Senior Product Security Architect to define and evolve a group-wide Product Security strategy across all regions and brands. This role provides strategic guidance, technical direction, and hands-on expertise to help security and engineering teams embed security into product development lifecycles in a federated environment. The role is the key advisor on AppSec standards, secure development practices, threat modelling, and security tooling (SAST, DAST, SCA, IaC scanning, container security, etc.), ensuring consistency and maturity in how applications are built and maintained.
Overall, the Senior Product Security Architect combines technical expertise with strategic vision and leadership to drive Flutter’s brands toward an advanced security posture that protects assets, meets compliance obligations, and enables business objectives.
About Flutter
Flutter consists of two commercial divisions (FanDuel and International) and our central Flutter Functions; COO, Finance & Legal. We work to deliver the Flutter Edge, differentiating our brands through Product, Tech, Expertise and Scale. We cover Product & Payments, Technology, Sportsbook Product & Trading, People, Property, Corporate Communications and Strategic Partnerships & Transformation.
What You’ll Do
* Strategic Leadership & Roadmap: Define and lead the enterprise-wide Application Security and SDLC strategy, with short, mid, and long-term goals aligned with security posture and digital transformation. Develop AppSec maturity models (e.g. OWASP SAMM, NIST SSDF, BSIMM) and work with business units to assess current state and define improvement plans. Drive the development of a global secure development policy, including approved tools, practices, and coding standards.
* Technology & Tooling Strategy: Evaluate, recommend, and support the rollout of AppSec tools (SAST, DAST, SCA, container and IaC scanners, runtime protections, CI/CD integrations). Collaborate with platform and DevOps teams to integrate tools into developer workflows and provide architecture guidance on secure design patterns in cloud-native and hybrid environments.
* Global Collaboration: Align strategies with the Associate Director of Group Enterprise Security and other domain leads. Define and monitor AppSec KPIs and metrics (e.g., vulnerability MTTR, scan coverage, risk acceptance trends) and report to leadership. Coordinate secure architecture reviews for critical initiatives and provide threat modelling support for large cross-brand projects.
* Continuous Improvement & Innovation: Stay current on emerging AppSec technologies and best practices. Evaluate new tools and features, reduce friction for developers while maintaining security, and improve program maturity across brands. Plan for product-related incident response and disaster recovery readiness.
* Project and Vendor Management: Oversee Secure by Design projects, manage vendor relationships, and ensure services align with group policies. Evaluate and select products or upgrades consistent with the strategic roadmap and ensure configurations meet requirements.
How You’ll Do It
* Several years of experience in software development and application security, with recent AppSec leadership or Security Architecture experience.
* Proven track record designing and implementing enterprise-scale secure development programs and embedding security into engineering culture.
* Broad experience integrating with tools such as SonarCloud, Checkmarx, GitHub Advanced Security, Snyk, Aqua, Prisma Cloud, Semgrep, etc.
* Strong understanding of CI/CD ecosystems (e.g., GitLab, Jenkins, Azure DevOps, GitHub Actions) and how to embed security into build and deploy processes.
* Experience in regulated industries or large enterprises is highly desirable. Mergers and Acquisitions integration experience is a plus.
* Familiarity with OWASP SAMM, OWASP ASVS, BSIMM, NIST SSDF, ISO 27034.
* Ability to lead teams and projects (DevSecOps lead, security architect, or SSDLC manager).
* Professional security certifications are valued (e.g., CISSP, CSSLP, CISM, and/or other AppSec certifications).
What’s In It For You
We are a flexible employer and offer a benefits package that can be personalised. We also celebrate success and provide opportunities for growth:
* Bonus scheme
* Uncapped holiday allowance
* Enhanced pension scheme
* Private healthcare
* Life assurance
* Income protection
* £1,000 annual self-development learning fund
* Flutter Sharesave Scheme
* Enhanced parental leave
About Flutter
We are a world leader in online sports betting and iGaming with a market-leading position in the US and globally. Our brands include FanDuel, Sky Betting & Gaming, Sportsbet, PokerStars, Paddy Power, Sisal, tombola, Betfair, MaxBet, Junglee Games and Adjarabet. We aim to be an inclusive employer and welcome applicants from diverse backgrounds. If you need adjustments to make this role work for you, please let us know so we can accommodate them.
Seniority level
Mid-Senior level
Employment type
Full-time
Job function
Information Technology
Industries
Entertainment Providers
#J-18808-Ljbffr