Application security engineer in education

Seven Education runs seven products on different tech stacks, and none of them has dedicated application security capacity today. As our (Senior) Application Security Engineer, you turn security findings into fixes and set one security baseline across all products. You report directly to our CISO and work closely with the engineering teams who build and run our platform. Schools trust us with the data of children and teachers, and you make sure that trust holds as our products and AI features grow.

• You run vulnerability management across our seven product estates. You tune the scanners, agree fix deadlines with Engineering, retest once fixes have landed and report on progress.
• You turn a large and growing volume of scanner findings from different tech stacks into a short list of real, exploitable issues that teams actually fix.
• You triage penetration test results together with the CISO, assess severity and priority, pass findings on to Engineering and retest once fixes have landed.
• You build automations that collect security evidence for our various audits and keep them running.
• You define and tune the security checks in our CI/CD pipelines, including secrets detection, DAST, fuzzing and the SBOM checks that matter for our products.
• You review new features and designs against one group baseline and keep data flow diagrams and the security architecture up to date.
• You support the CISO in building security alerting, so that we can see security events across our IT systems.
• You design the production access model with Engineering and IT and start its rollout.

• You have at least five years of experience in application or product security, or in engineering with a security focus, ideally in SaaS, startups or scaleups across different tech stacks and cloud platforms.
• You have a track record of driving security issues from discovery to a verified fix, and you work with engineers to find a workable path instead of blocking their releases.
• You read code across different tech stacks and write scripts and automation, for example in Python or Go or JavaScript.
• You are hands on with SAST, DAST, SCA and CI/CD pipeline security.
• You prioritise clearly, explain risk in plain language and take ownership of your topics with minimal supervision.
• You build AI harnesses and agents that support security work such as vulnerability triage, scanning and analysis of indicators of compromise.
• You are fluent in English, which you use daily to work with engineering teams and the CISO.
• Будет плюсом: Cloud security experience on sovereign cloud, penetration testing experience or a certification such as OSCP or OSWE, and an understanding of the security of AI and LLM features

• At Seven Education, you contribute to shaping the future of education in Europe and help improve the daily work of schools. You can take two paid days per year for volunteer activities.
• Flexible working hours, hybrid models, remote work and workations within the EU, Switzerland and the UK are part of how we work.
• Dedicated learning time, access to learning platforms, language courses in German and English, and continuous development opportunities support your personal and professional growth.
• You will work in a supportive, collaborative environment that values trust, openness and teamwork. A team-building budget is available for workshops and shared events.
• You will have the opportunity to take responsibility, shape structures and grow with a company that combines a start-up mindset with the ambition to build a leading European software group.
• 30 days of paid vacation, half-days off on Christmas Eve and New Year's Eve, and dog-friendly offices.