> Markdown version of [/jobs/ext/4154173-senior-security-engineer](https://www.wearedevelopers.com/jobs/ext/4154173-senior-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Security Engineer - **Company:** BibliU - **Location:** UK (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** OpenTofu, Adobe InDesign, Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Software System Penetration Testing, Software as a Service, Cloud Computing, Cloud Computing Security, Code Generation, Continuous Integration, Data Mapping, Identity and Access Management, Intrusion Detection and Prevention, Information Systems Security Architecture Professional, Key Management, Network Segmentation, Open Web Application Security, PCI Data Security Standards, Systems Development Life Cycle, Reliability Engineering, Security Information and Event Management, Data Streaming, Web Applications, Data Logging, Retrieval-Augmented Generation, Large Language Models, Software Security, GWAPT, Kubernetes, Build Tools, Static Application Security Testing, Dynamic Application Security Testing - **Published:** October 9, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=2016f1d5f6a5a270 ## About the Role * 5+ years in a security engineering, application security, or cloud security role, with meaningful time spent hands-on rather than purely advisory * Direct experience operating or contributing to SOC 2 Type II controls in a live environment, not just preparing for an initial audit, but sustaining and evidencing controls over time * Practical penetration testing skills: web application, API, and cloud infrastructure testing, with the ability to run assessments internally and validate third-party findings * Strong cloud security background (AWS): IAM design, network segmentation, encryption, secrets management, and workload isolation * Working knowledge of PCI DSS requirements and how to scope, segment, and evidence a cardholder-data environment * Solid grasp of GDPR as it applies to engineering: lawful basis, data minimisation, retention, subject rights, cross-border transfers, and sub-processor management * Secure architecture and threat modelling experience across distributed, service-based systems * Strong hands-on engineering ability: able to read and reason about application code, write scripts and automation, and integrate security checks into CI/CD * Experience securing containerised workloads and infrastructure-as-code (Kubernetes, OpenTofu, or equivalents) * Ability to influence engineers and product teams without authority, make pragmatic risk trade-offs rather than absolutist ones, and challenge security controls that create cost or friction without proportionate benefit * Clear written communication: you'll be producing control documentation, findings, and customer-facing security responses * Experience securing AI/LLM systems: prompt injection, tool-use and agent permissions, model and data exfiltration risks, RAG pipeline security, and evaluation of AI-generated code Good to have: * Exposure to ISO 27001, or experience running a multi-framework compliance programme * Offensive security certifications (OSCP, OSWE, GWAPT) or equivalent demonstrable experience * Detection engineering and SIEM experience, including writing and tuning detections * Familiarity with AI security frameworks such as the OWASP Top 10 for LLM Applications, NIST AI RMF, or ISO/IEC 42001 * Experience in a high-growth SaaS environment, particularly one handling sensitive personal data at scale * Background in EdTech, or experience with sector-specific requirements such as accessibility, student data privacy (FERPA), or institutional procurement security reviews * Experience using controlled security experiments, incident simulations, chaos engineering, or similar techniques to test how systems behave when assumptions or safeguards fail * Prior involvement in incident response for a real production incident, including post-incident review ## Description We're hiring a Security Engineer to own the security posture of our platform and production workloads. This is a hands-on engineering role sitting at the intersection of architecture, engineering and security. You'll make sure security is designed into systems rather than bolted on afterwards, test whether our security assumptions and controls actually work, and help teams build systems that remain secure and resilient when things go wrong. Your role will include running offensive testing against our own infrastructure. A significant part of the role is securing how we build and ship AI products. As teams move faster with AI-assisted development, you'll define the sandboxing, isolation, permissions and guardrail patterns that let that happen safely, and tune them as the tooling and threat landscape change. You'll work in close partnership with Engineering and our AI practice, embedded in design reviews and delivery work rather than reviewing from the outside. Our IT function leads compliance administration, you'll provide the engineering expertise and technical controls needed to support SOC 2, GDPR and PCI DSS obligations. We value evidence over assumptions - we want to know whether security measures work in practice, not simply whether they exist., * Own the engineering implementation and continuous improvement of security controls supporting SOC 2 Type II, working with IT on evidence collection and external audits * Act as the security partner in architecture and design reviews, setting secure-by-default patterns for new services, data flows, and integrations, while making pragmatic trade-offs between risk and delivery * Design, propose, and tune sandboxing and isolation models for AI-assisted and AI-generated code, including execution boundaries, secrets handling, permissions, dependency controls, and output validation * Own our offensive security testing, combining internal application, cloud and infrastructure testing with third-party penetration testing where useful; test whether important security assumptions actually hold, and verify remediation * Maintain and extend our GDPR and PCI DSS control posture, working with Legal, Finance, and Engineering on data mapping, retention, cardholder-data scope, and DPIAs * Work with Platform Engineering to tune security tooling and automation across the SDLC: SAST, DAST, dependency and container scanning, IaC policy checks, and CI/CD gates - focussing on high-signal, actionable checks and removing controls or gates that create friction without materially reducing risk * Lead threat modelling for high-risk services and AI features, and translate findings into prioritised, actionable engineering work * Work with Engineering to improve detection and response capability: logging coverage, alerting quality, runbooks, and participation in incident response * Support customer and prospect security reviews, questionnaires, and due diligence with accurate, evidence-backed responses * Raise the security baseline across engineering through guidance, tooling, and enablement rather than gatekeeping