Security Engineer

BibliU Ltd.; Greater London; Remote; GBP 75.000 - 110.000; Vollzeit

Benefits dieser Stelle

35 days holiday

Birthday off

Wellness Fridays off

Maternity/Paternity allowance

Flexible hours

WFH allowance

Life Insurance

Eye care stipend

Zusammenfassung

BibliU is hiring a Security Engineer to strengthen the security of our platform and AI-enabled workloads. This hands-on role sits at the intersection of architecture, engineering and security, with ownership from day one and collaboration with our AI practice and IT function.

You will design and test sandboxing patterns for AI features, run internal and external security testing, and help evidence controls for SOC 2, GDPR and PCI DSS.

Qualifikationen

• 1–3 years in security, software or infra engineering.
• Hands-on with AWS fundamentals: IAM, networking, encryption.
• Able to write scripts and read application code.
• Practical web app and API security testing.
• Interest in AI/LLM security with demonstrable project.
• Pragmatic risk approach to balance controls.

Aufgaben

• Build and run experiments to test whether security controls actually work.
• Own security tooling in CI/CD (SAST, DAST, dependency and container scanning, IaC policy checks).
• Run internal and external security testing; verify fixes.
• Design sandboxing, isolation and permission patterns for AI features.
• Contribute to threat modelling and design reviews for new services.
• Implement and evidence SOC 2, GDPR and PCI DSS controls.
• Improve logging, alerting and runbooks; participate in incident response.
• Assist with customer security reviews with evidence-backed responses.
• Raise the security baseline across engineering through tooling.

Kenntnisse

AWS fundamentals

Automation scripting

Web security testing

API security testing

AI security interest

Risk assessment

Tools

SAST tooling

DAST tooling

Container scanning

Kubernetes

OpenTofu

Jobbeschreibung

BibliU is an award-winning, technology-led B2B company transforming the $65bn educational content industry. With a 90% CAGR the past 5 years, we are just getting started. We've cracked the code on Day 1 access to affordable digital course materials for students, while delivering comprehensive campus store solutions that foster human relationships, and increase our stickiness in the world of AI.

The result? Measurable impact: 10% higher student retention, 1-point GPA increases, and partnerships with 170 universities serving 600,000 students each year.

We've fundamentally changed how universities procure, distribute, and manage learning content. We partner with 4,000+ publishers, including Pearson, Oxford University Press, and Wiley to deliver content to universities, and provide rich engagement data and interactive tools like quizzes that help students actually learn.

Here’s what makes our story compelling:

Founded in late 2015 as an Oxford University spin out, we've grown explosively with 90% CAGR over the last five years, including 65% in FY25, reaching $100m in annual revenue. Our Series B raised $23m led by Nesta Impact Investments (with Guinness Asset Management, Stonehage Fleming, and Oxford Sciences Enterprises). In late 2023, we acquired Texas Book Company (now 'BibliU Campus') to become the only fully vertically integrated player in the market, driving US organic growth which now represents 90% of our business.

We're hungry for more. We're actively building our M&A pipeline as we compete head-to-head against legacy bricks-and-mortar providers to improve the faculty and student experience while boosting the financial sustainability of universities.

Our culture is collaborative, high-growth, and agile. You’ll join an experienced and motivated executive team with backgrounds from Instructure (Canvas) and other successful edtech companies with exit experience. We operate as a distributed team across the UK and US, with offices in London.

Position Overview

We're hiring a Security Engineer to help strengthen the security of our platform and production workloads, with real ownership of key areas from day one. This is a hands‑on engineering role sitting at the intersection of architecture, engineering and security. You’ll make sure security is designed into systems rather than bolted on afterwards, test whether our security assumptions and controls actually work, and help teams build systems that remain secure and resilient when things go wrong. Your role will include running offensive testing against our own infrastructure, alongside external penetration testers.

A significant part of the role is securing how we build and ship AI products. As teams move faster with AI-assisted development, you'll help define and test the sandboxing, isolation, permissions and guardrail patterns that let that happen safely, and tune them as the tooling and threat landscape change.

You’ll work in close partnership with Engineering and our AI practice, embedded in design reviews and delivery work rather than reviewing from the outside. Our IT function leads compliance administration; you’ll provide the engineering expertise and technical controls needed to support SOC 2, GDPR and PCI DSS obligations. We value evidence over assumptions - we want to know whether security measures work in practice, not simply whether they exist.

What you will be doing:

• Build and run repeatable experiments that test whether our security controls actually work, starting with detection, secrets handling and AI sandboxing
• Own security tooling in our CI/CD pipeline (SAST, DAST, dependency and container scanning, IaC policy checks), focusing on high-signal, actionable checks and removing friction that doesn’t reduce risk
• Run internal application, API and cloud security testing, work alongside external pen testers, and verify that fixes hold
• Help design and test sandboxing, isolation and permission patterns for AI-assisted and AI-generated code
• Contribute to threat modelling and design reviews for new services and AI features, turning findings into clear engineering work
• Work with our Head of IT and VP of Engineering to implement and evidence technical controls for SOC 2, GDPR and PCI DSS
• Improve logging, alerting and runbooks, and take part in incident response
• Help answer customer security reviews with accurate, evidence‑backed responses
• Raise the security baseline across engineering through tooling and enablement rather than gatekeeping

What we are looking for

Must have:

• 1–3 years in security, software or infrastructure engineering, or equivalent demonstrable work (CTFs, bug bounties, homelab, open‑source contributions)
• Hands‑on with AWS fundamentals: IAM, networking, encryption and secrets management
• Strong hands‑on engineering: able to write scripts and automation, and to read and reason about application code
• Practical web application and API security testing skills
• Interest in AI/LLM security (prompt injection, agent permissions, data exfiltration), with something you’ve built or broken to show for it
• A pragmatic approach to risk: willing to challenge controls that add friction without proportionate benefit

Good to have:

• Exposure to SOC 2, PCI DSS or GDPR controls in a live environment
• Experience with containers and infrastructure-as-code (Kubernetes, OpenTofu or equivalents)
• Offensive security certifications (OSCP, OSWE, GWAPT), or progress towards them
• Detection engineering or SIEM experience
• Familiarity with the OWASP Top 10 for LLM Applications or NIST AI RMF
• Experience with chaos engineering, incident simulations or controlled security experiments
• Involvement in a real production incident or post‑incident review
• Experience in high-growth SaaS or EdTech

What you’ll get

• Real ownership of the security areas listed above, with scope that grows as you do
• Hands‑on AI security work that few roles at this level offer
• Close work with our VP of Engineering, Head of IT and external security specialists
• A budget for certifications such as OSCP

Our benefits are all aimed at supporting a healthy work‑life balance and cultivating a company culture where you can bring your whole, human self to work.

Here’s what we offer:

• 35 days holiday per year (excluding public holidays!) - yep, that’s not a typo!
• Your birthday off
• 12 scheduled company wellness Fridays off per year
• Enhanced maternity & paternity allowance
• Flexible working hours - we’re a remote team spread across the US and UK
• Work‑from‑home allowance to help you set up your dream WFH station
• Life Insurance up to 4 x salary
• Annual eye test and up to £100 towards frames for glasses required for DSE work

We strongly encourage candidates of all different backgrounds, experiences and identities to apply. Each new hire is an opportunity for us to bring in a different perspective and BibliU is committed to building an inclusive and supportive workplace where everyone can do rewarding work.

Please note: We do not work with external recruiters/recruitment agencies. This position will be filled directly by BibliU and we kindly request that external recruiters/recruitment agencies refrain from submitting candidates for this role.