SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
BibliU is a high-growth edtech company transforming the $65bn educational content industry. Founded in 2015 as an Oxford University spin-out, the company has achieved 90% CAGR over five years and now generates $100m+ in annual revenue. BibliU partners with 170+ universities and 4,000+ publishers (including Pearson, Oxford University Press, Wiley) to deliver affordable digital course materials and campus store solutions to 600,000+ students annually.
You will own the security posture of BibliU's platform and production workloads in a hands-on engineering role at the intersection of architecture, engineering, and security. This is not a compliance-focused position—you'll embed security into system design from the start, conduct offensive testing against internal infrastructure, and help teams build resilient systems that remain secure when things fail.
A significant portion of your work will focus on securing AI-assisted development. As engineering teams move faster with AI tools, you'll define sandboxing, isolation, permissions, and guardrail patterns that enable safe AI-powered development, and continuously tune these as tooling and threats evolve.
You'll work embedded with Engineering and the AI practice in design reviews and delivery work, not reviewing from the outside. You'll partner with IT on compliance administration, providing the technical controls and engineering expertise needed to support SOC 2 Type II, GDPR, and PCI DSS obligations. The role values evidence over assumptions—you'll validate whether security measures actually work in practice.
Key responsibilities include: owning the engineering implementation and continuous improvement of SOC 2 Type II controls; acting as the security partner in architecture and design reviews; designing sandboxing and isolation models for AI-assisted and AI-generated code; conducting offensive security testing (application, cloud, infrastructure); maintaining GDPR and PCI DSS control posture; tuning security tooling across the SDLC (SAST, DAST, dependency scanning, IaC checks, CI/CD gates); leading threat modeling for high-risk services; improving detection and response capability; supporting customer security reviews and due diligence; and raising the security baseline through guidance and enablement rather than gatekeeping.
You'll report to the VP Engineering and work within a distributed team across the UK and US, with offices in London.
**Requirements:**
Must have:
- 5+ years in security engineering, application security, or cloud security roles with meaningful hands-on experience (not purely advisory)
- Direct experience operating or contributing to SOC 2 Type II controls in live environments, sustaining and evidencing controls over time
- Practical penetration testing skills: web application, API, and cloud infrastructure testing; ability to run internal assessments and validate third-party findings
- Strong cloud security background (AWS): IAM design, network segmentation, encryption, secrets management, workload isolation
- Working knowledge of PCI DSS requirements: scoping, segmentation, and evidencing cardholder-data environments
- Solid grasp of GDPR as applied to engineering: lawful basis, data minimization, retention, subject rights, cross-border transfers, sub-processor management
- Secure architecture and threat modeling experience across distributed, service-based systems
- Strong hands-on engineering ability: read and reason about application code, write scripts and automation, integrate security checks into CI/CD
- Experience securing containerized workloads and infrastructure-as-code (Kubernetes, OpenTofu, or equivalents)
- Ability to influence engineers and product teams without authority; make pragmatic risk trade-offs rather than absolutist ones; challenge controls that create cost or friction without proportionate benefit
- Clear written communication for control documentation, findings, and customer-facing security responses
- Experience securing AI/LLM systems: prompt injection, tool-use and agent permissions, model and data exfiltration risks, RAG pipeline security, evaluation of AI-generated code
Good to have:
- Exposure to ISO 27001 or experience running a multi-framework compliance program
- Offensive security certifications (OSCP, OSWE, GWAPT) or equivalent demonstrable experience
- Detection engineering and SIEM experience, including writing and tuning detections
- Familiarity with AI security frameworks (OWASP Top 10 for LLM Applications, NIST AI RMF, ISO/IEC 42001)
- Experience in high-growth SaaS environments handling sensitive personal data at scale
- EdTech background or experience with sector-specific requirements (accessibility, student data privacy/FERPA, institutional procurement security reviews)
- Experience with controlled security experiments, incident simulations, chaos engineering, or similar techniques
- Prior involvement in production incident response and post-incident review
