How your CV stacks up
Upload your CV to see how well it fits this job role
?%
MrQ
MrQ - we're an awesome, award-winning online casino launched in 2018. We're big on tech, big on performance, and most of all - big on fun. Over the years, we have experienced explosive growth - which means we need more rock stars to join our quest for total world domination.
About the Role
This is a founding leadership role. We’re building a dedicated security function at MrQ, with its own strategy, roadmap, team, and budget, and you’ll be the one building it. You won’t start from zero, and you won’t be handed someone else’s plan. Serious groundwork is already in place: an independent security maturity baseline, a live GRC platform, EDR and identity programmes in deployment, and security investment with real backing from the executive team. The strategy and roadmap from here are yours to define. Pressure-test what’s in flight, keep what works, change what doesn’t.
You’ll report directly to the CTO and lead both Security and IT Operations. The Lead of IT Ops reports to you, and you’ll hire and lead the security engineering team, starting with a Principal Security Engineer.
This is a player-coach role. We need someone strategic enough to own board-level risk conversations, and technical enough to earn the respect of a Principal-level engineer and challenge architecture decisions on an AWS-native platform. With a small team and serious AI leverage, you’ll build as well as lead. Threat modelling, architecture reviews, and AI-powered security tooling are part of the job, not beneath it. Here, automation replaces headcount by design.
Responsibilities
-
Own the security strategy
- Define and own the security strategy and maturity roadmap.
- Set priorities, allocate budget and effort, and be accountable for the targets you set.
- Report security posture, risk, and investment cases to the CTO, executive team, and board. Translate technical risk into business impact.
- Make sure security is part of every major technology and product decision, including how we build with AI, not just what we buy.
-
Build and lead the team
- Lead the IT Operations function through its Lead: identity and access, employee onboarding and offboarding, the device fleet, SaaS tools, and data requests (DSARs).
- Hire, develop, and lead the security engineering team, starting with a Principal Security Engineer.
- Design the function for resilience: clear ownership, documented processes, no single points of failure.
-
Run security engineering and operations
- Own the security tooling end to end (EDR/XDR, SIEM, identity, vulnerability management, email security, DLP), including the deployments already in flight.
- Own security incident and breach response: deciding severity, directing containment, regulatory notification (ICO, UKGC), and post-incident review. Production incidents belong to Engineering’s on-call team. You own the security path and the call on when an incident is, or might become, a security event.
- Direct security across a cloud-native AWS estate: platform, payment flows, APIs, player data.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
-
Own governance, risk, and compliance
- Own the GRC programme: risk register, policies, control framework, audit readiness (ISO 27001 path, Cyber Essentials, GDPR), and the compliance-automation platform behind it.
- Partner with Compliance on the regulatory side of a UKGC-licensed operator: player data protection, technical standards, audit evidence.
- Build documentation to a standard that survives external scrutiny: auditors, regulators, and commercial due diligence.
-
Secure how we build with AI
- MrQ is deeply AI-native: AI agents, internal AI platforms, and AI-assisted engineering across the company. Own the security model for all of it: the AI gateway, agent permissions and sandboxing, data boundaries, and governance of third-party AI tools.
- Own the company’s AI usage policy: which tools are approved, what data they can touch, and what agents are allowed to do on their own.
- This is greenfield in most companies. Here it’s live production surface. Treat it as a first-class part of the threat model.
-
Build the security culture
- Own security awareness across the company: training, phishing simulations, onboarding inductions, and security champions inside the squads. Make security something people do, not something done to them.
-
Own the security vendor portfolio
- Own vendor selection, commercial relationships, and spend across the security stack. Run build-vs-buy honestly. Kill tools that don’t earn their keep.
Requirements
- 10+ years in security, including 3+ years leading a security function or team with real budget and hiring ownership
- Built or significantly matured a security function before: you’ve taken a company up a maturity curve, not just operated inside a mature one
- Deep technical credibility: you can hold your own with senior security and platform engineers on EDR, SIEM, identity, and cloud security (AWS), and you know when to defer
- Direct experience owning GRC: policies, control frameworks, risk registers, and leading audits (ISO 27001, SOC 2, Cyber Essentials or equivalent)
- Led security incident response at company level: you’ve owned real incidents, not just contributed to them
- Managed managers or senior individual contributors, ideally including an IT operations remit
- Exec-level communicator: you can hold a board conversation about risk appetite and a whiteboard session about detection logic in the same day
- Pragmatist: balances risk with business enablement in a company that ships fast
- Builder’s mindset in the age of AI: you’d rather automate a control than staff it, and you use AI tooling to make a small team punch far above its weight
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Highly Desirable
- iGaming, fintech, or another heavily regulated industry; UKGC or similar gaming regulation and player data protection are a strong plus
- Experience securing AI/LLM systems: agent architectures, model access controls, AI tooling governance
- Experience preparing a security function for commercial due diligence or external investment scrutiny
- Application or product security background in a platform business
- Relevant senior certifications (CISSP, CISM, CCISO) or an equivalent proven track record
What We Offer
At MrQ, we take pride in providing an array of fantastic benefits to our valued team members. Enjoy a competitive salary package that recognizes your hard work and dedication. Need some extra time off? We've got you covered with additional leave days, and we believe in celebrating life's special moments, including your birthday, with dedicated birthday leave. Family matters to us, too, which is why we offer a generous four-week parental leave. Your well-being is our priority, supported by international health and life insurance. Stay motivated with wellness incentives and seize opportunities for personal and professional growth with our growth allowance. Embrace a flexible working environment that caters to your needs, and join our friendly and multinational team, where collaboration and camaraderie flourish. At MrQ, we're committed to ensuring that your experience with us goes beyond just a job – it's a fulfilling journey with a supportive community.
We are committed to fostering a workplace that values and celebrates diversity. We welcome individuals of all backgrounds and experiences, and we believe that a diverse and inclusive environment leads to innovation and success. We actively promote equal opportunities for all employees and strive to create a space where everyone's voices are heard and respected. Join us in our journey to build a truly inclusive workplace where every person can thrive and contribute to our collective success.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location