> Markdown version of [/jobs/ext/3944884-security-engineer](https://www.wearedevelopers.com/jobs/ext/3944884-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Engineer

- **Company:** Bibliu
- **Location:** UK (Remote available)
- **Experience:** Starter
- **Contract:** Permanent contract
- **Skills:** OpenTofu, Adobe InDesign, Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Software as a Service, Cloud Computing Security, Code Generation, Continuous Integration, Identity and Access Management, Intrusion Detection and Prevention, Key Management, Open Web Application Security, PCI Data Security Standards, Reliability Engineering, Security Information and Event Management, Web Applications, Data Logging, Large Language Models, Software Security, GWAPT, Kubernetes, Free and Open-Source Software, Build Tools, Static Application Security Testing, Dynamic Application Security Testing
- **Published:** October 27, 2026
- **Apply:** https://startup.jobs/security-engineer-bibliu-10372906

## About the Role

* 1-3 years in security, software or infrastructure engineering, or equivalent demonstrable work (CTFs, bug bounties, homelab, open-source contributions)
 * Hands-on with AWS fundamentals: IAM, networking, encryption and secrets management
 * Strong hands-on engineering: able to write scripts and automation, and to read and reason about application code
 * Practical web application and API security testing skills
 * Interest in AI/LLM security (prompt injection, agent permissions, data exfiltration), with something you've built or broken to show for it
 * A pragmatic approach to risk: willing to challenge controls that add friction without proportionate benefit
 * Clear written communication

Good to have:

 * Exposure to SOC 2, PCI DSS or GDPR controls in a live environment
 * Experience with containers and infrastructure-as-code (Kubernetes, OpenTofu or equivalents)
 * Offensive security certifications (OSCP, OSWE, GWAPT), or progress towards them
 * Detection engineering or SIEM experience
 * Familiarity with the OWASP Top 10 for LLM Applications or NIST AI RMF
 * Experience with chaos engineering, incident simulations or controlled security experiments
 * Involvement in a real production incident or post-incident review
 * Experience in high-growth SaaS or EdTech

## Description

We're hiring a Security Engineer to help strengthen the security of our platform and production workloads, with real ownership of key areas from day one. This is a hands-on engineering role sitting at the intersection of architecture, engineering and security. You'll make sure security is designed into systems rather than bolted on afterwards, test whether our security assumptions and controls actually work, and help teams build systems that remain secure and resilient when things go wrong. Your role will include running offensive testing against our own infrastructure, alongside external penetration testers.

A significant part of the role is securing how we build and ship AI products. As teams move faster with AI-assisted development, you'll help define and test the sandboxing, isolation, permissions and guardrail patterns that let that happen safely, and tune them as the tooling and threat landscape change.

You'll work in close partnership with Engineering and our AI practice, embedded in design reviews and delivery work rather than reviewing from the outside. Our IT function leads compliance administration; you'll provide the engineering expertise and technical controls needed to support SOC 2, GDPR and PCI DSS obligations. We value evidence over assumptions - we want to know whether security measures work in practice, not simply whether they exist.

What you will be doing:

 * Build and run repeatable experiments that test whether our security controls actually work, starting with detection, secrets handling and AI sandboxing
 * Own security tooling in our CI/CD pipeline (SAST, DAST, dependency and container scanning, IaC policy checks), focusing on high-signal, actionable checks and removing friction that doesn't reduce risk
 * Run internal application, API and cloud security testing, work alongside external pen testers, and verify that fixes hold
 * Help design and test sandboxing, isolation and permission patterns for AI-assisted and AI-generated code
 * Contribute to threat modelling and design reviews for new services and AI features, turning findings into clear engineering work
 * Work with our Head of IT and VP of Engineering to implement and evidence technical controls for SOC 2, GDPR and PCI DSS
 * Improve logging, alerting and runbooks, and take part in incident response
 * Help answer customer security reviews with accurate, evidence-backed responses
 * Raise the security baseline across engineering through tooling and enablement rather than gatekeeping