(Senior) Application Security Engineer

Seven Education; Köln; Hybrid; EUR 90,000 - 120,000; Full time

Benefits offered by this job

Volunteer days

Hybrid work model

Language courses

Learning platforms

Team & collaboration budget

Ownership & growth

30 days vacation

Dog-friendly offices

Job summary

Seven Education, a European EdTech group, is seeking a (Senior) Application Security Engineer to turn security findings into fixes and set a security baseline across all products. You report to the CISO and collaborate with engineering teams to protect data for schools and teachers as the platform and AI features scale.

You will drive vulnerability management across seven product estates, triage scanner findings, conduct penetration test triage with the CISO, and build automations for audits and

Qualifications

• At least five years in application or product security, or engineering with security focus.
• Experience driving security issues from discovery to verified fix across SaaS/startups or scaleups.
• Proficiency in scripting/automation (Python/Go/JavaScript).
• Hands-on with security tooling: SAST, DAST, SCA and CI/CD pipeline security.
• Clear risk communication and ownership of topics with minimal supervision.
• Knowledge of AI-assisted security work and indicators of compromise.

Responsibilities

• Vulnerability management across seven product estates, tuning scanners, setting fix deadlines and retesting.
• Turn scanner findings into a short list of real, exploitable issues for teams to fix.
• Triage penetration test results with the CISO, assess severity, and retest after fixes.
• Build automations to collect security evidence for audits.
• Define and tune security checks in CI/CD pipelines, including secrets detection, DAST, fuzzing and SBOM checks.
• Review new features against a baseline and keep data flow diagrams and security architecture up to date.
• Support the CISO in building security alerting across IT systems.
• Design the production access model with Engineering and IT and rollout.

Skills

Application security

Fixes to vulnerabilities

Code & automation

Security tooling (SAST/DAST/SCA)

CI/CD security

Risk communication

AI-assisted security work

Fluent English

Tools

SAST

DAST

SCA

CI/CD security

Job description

Our mission

Seven Education develops a smart, AI-powered platform that helps schools and educational institutions work more efficiently. Our products reduce administrative workload, improve communication and enable teachers, institutions, and decision-makers to focus on what matters most: learning, growth and people.

As a European EdTech group with around 300 employees, we build intuitive and scalable solutions used widely across the education landscape. Every day, they help create clarity, streamline workflows and strengthen collaboration. We build with courage, ownership and meaningful collaboration, and we stay inspired by the real impact our products create for the people at the heart of education. Our ambition is clear: to become Europe's leading EdTech brand.

If you want to join that journey and grow with us, we would love to hear from you.

Your mission

Seven Education runs seven products on different tech stacks, and none of them has dedicated application security capacity today. As our (Senior) Application Security Engineer, you turn security findings into fixes and set one security baseline across all products. You report directly to our CISO and work closely with the engineering teams who build and run our platform. Schools trust us with the data of children and teachers, and you make sure that trust holds as our products and AI features grow.

What you’ll do

• Vulnerability management: You run vulnerability management across our seven product estates. You tune the scanners, agree fix deadlines with Engineering, retest once fixes have landed and report on progress.
• Cutting through the noise: You turn a large and growing volume of scanner findings from different tech stacks into a short list of real, exploitable issues that teams actually fix.
• Penetration test triage: You triage penetration test results together with the CISO, assess severity and priority, pass findings on to Engineering and retest once fixes have landed.
• Audit evidence: You build automations that collect security evidence for our various audits and keep them running.
• Pipeline security: You define and tune the security checks in our CI/CD pipelines, including secrets detection, DAST, fuzzing and the SBOM checks that matter for our products.
• Design and feature reviews: You review new features and designs against one group baseline and keep data flow diagrams and the security architecture up to date.
• Security alerting: You support the CISO in building security alerting, so that we can see security events across our IT systems.
• Production access model: You design the production access model with Engineering and IT and start its rollout.

What you’ll bring

• Application security experience: You have at least five years of experience in application or product security, or in engineering with a security focus, ideally in SaaS, startups or scaleups across different tech stacks and cloud platforms.
• Fixes, not just findings: You have a track record of driving security issues from discovery to a verified fix, and you work with engineers to find a workable path instead of blocking their releases.
• Code and automation: You read code across different tech stacks and write scripts and automation, for example in Python or Go or JavaScript.
• Security tooling: You are hands on with SAST, DAST, SCA and CI/CD pipeline security.
• Clear risk communication: You prioritise clearly, explain risk in plain language and take ownership of your topics with minimal supervision.
• AI-assisted security work: You build AI harnesses and agents that support security work such as vulnerability triage, scanning and analysis of indicators of compromise.
• Fluent English: You are fluent in English, which you use daily to work with engineering teams and the CISO.
• Nice to have: Cloud security experience on sovereign cloud, penetration testing experience or a certification such as OSCP or OSWE, and an understanding of the security of AI and LLM features.

Where you’ll be

We work hybrid. Your base is one of our offices in Hamburg, Berlin, Cologne, Göttingen or Koblenz, where you are on site several days per week. On the other days you can work flexibly from home. We value time together in person, because good collaboration happens in conversation and not at the desk alone.

What we offer

• Purpose & Social Impact: At Seven Education, you contribute to shaping the future of education in Europe and help improve the daily work of schools. You can take two paid days per year for volunteer activities.
• Flexibility & Modern Work: Flexible working hours, hybrid models, remote work and workations within the EU, Switzerland and the UK are part of how we work.
• Learning & Development: Dedicated learning time, access to learning platforms, language courses in German and English, and continuous development opportunities support your personal and professional growth.
• Team & Collaboration: You will work in a supportive, collaborative environment that values trust, openness and teamwork. A team-building budget is available for workshops and shared events.
• Ownership & Growth: You will have the opportunity to take responsibility, shape structures and grow with a company that combines a start-up mindset with the ambition to build a leading European software group.
• Time Off & Everyday Perks: 30 days of paid vacation, half-days off on Christmas Eve and New Year's Eve, and dog-friendly offices.

Diversity Statement

At Seven Education, we believe that diversity drives innovation and inclusion strengthens collaboration. We welcome people of all backgrounds, identities, and perspectives, because transforming education for a better tomorrow starts with equal opportunities today. If you're excited about this role but don't meet every requirement, we'd still love to hear from you.