Head of Security

We build mobile games with partners whose intellectual property carries strict security obligations. Meeting those obligations in full — and being ready to respond properly when something does go wrong — is what this role owns. We’re hiring our first dedicated security person. Two priorities for year one: meet the security standards our partners require of everyone handling their material, and make the company ready for an incident before one happens — so we know what to do, who decides, and how to communicate within hours rather than days. Along the way we’ll go through a SOC 2 audit. We’re a team of 150, a large share of whom are external collaborators: art studios, freelancers, outsourced QA. We operate in Poland and Israel. This is a function we’re building from scratch, which means you set the priorities rather than inherit them. This role is not for you if you’re looking for mature infrastructure, a SOC team, and an enterprise budget. We don’t have those and won’t for at least a year. There’s no SIEM to tune and no alert queue to triage — if that’s the part of the work you enjoy most, you’ll be bored here. This role is for you if you want to decide what matters yourself and see the result in weeks rather than years. Your Responsibilities Make us ready for an incident. Scenarios, roles, decision paths, tabletop exercises with management and production. Put logging and evidence handling in place so that after an incident we can actually answer “what exactly got out”. Get us qualified to handle top-tier confidential material. Map the licensor’s requirements against what we have, identify the gaps and close them — including how material moves between us and external contributors. Put our external collaboration in order. Risk tiers, contractual security requirements, onboarding and offboarding, working models that don’t leave copies on other people’s machines. Lock down what’s critical. Publishing accounts, build signing keys, production environment access. Take us through SOC 2 — from agreeing scope, through selecting an auditor and a compliance platform, to the report. Choose and roll out the baseline stack — device management, endpoint protection, email, code and secret scanning. What we buy is your call. Work with producers and developers so that they want to work with you rather than around you. What We're Looking For You’ve built security in a company that didn’t have it, or you were the first security hire in a growing organisation. You’ve run a real incident — not an exercise. You’ll tell us what you did in the first hour and what went wrong. You’ve worked with data or material whose leak carried contractual consequences — games, media, SaaS, finance, anywhere. You’ve been through a SOC 2 or ISO 27001 audit as the person accountable for it, not as a participant. You can pick a tool and justify its cost, not just name vendors. You explain technical things to non-technical people without acronyms and without condescension. English fluent in writing and conversation — our auditor and part of the company work in English. Polish is useful but not required. Nice to have Experience with content licensor security requirements — MPA Content Security Best Practices, TPN, studio security addenda. Working with distributed external contributors and remote workstation models (VDI). Games or media — understanding what a pre-release leak actually costs. What we offer Full ownership of your area, reporting directly to the COO. A budget for tooling and for the audit — we’ll discuss actual figures in the first conversation. A budget for outside help: consultants, pentests, SOC 2 advisory. We don’t expect you to do all of it alone. An exhilarating role in the mobile RPG gaming industry. Flexible employment terms: employment contract or B2B. Work environment of your choice: remote, in-office, or a hybrid model. A competitive benefits package tailored to your needs. A modern office space equipped with everything you need to succeed. Salary range: 25 000 - 30 000 PLN