Constructor’s mission is to enable all educational organisations to provide high-quality digital education to 10x people with 10x efficiency.
With strong expertise in machine intelligence and data science, Constructor’s all-in-one platform for education and research addresses today’s pressing educational challenges: access inequality, tech clutter, and low engagement of students.
Please send your resume in English only.We're looking for a Head of Cybersecurity to expand and lead our security function across four areas: application security, security compliance, infrastructure & cloud security, and business application security. You'll take over a small existing security team, with a mandate to grow it as the company scales.
This is a hands-on leadership role. You'll set direction and represent security to leadership, but you're also expected to dig into technical detail with engineering, IT, and compliance teams.
Duties & ResponsibilitiesApplication security
- Build and run our AppSec program, including agentic/AI-assisted security reviews of code and pull requests
- Integrate security checks into CI/CD pipelines so vulnerabilities are caught before production
- Run developer security training and champion secure coding practices org-wide
- Evaluate and roll out AI coding tools in ways that improve, not undermine, code security
Security compliance
- Own ISO 27001 and SOC 2 certification and ongoing security audits
- Collect requirements from stakeholders and build a roadmap for additional certifications as the business requires them
- Maintain policies, controls, and evidence in a way that scales without slowing teams down
Infrastructure & Cloud Security
- Work closely with our DevOps organization to secure our Kubernetes infrastructure and cloud environments, including sovereign cloud deployments
- Define security standards for infrastructure-as-code, network architecture, and access control
- Partner with Engineering teams on secure-by-default configurations
Business Application Security
- Work closely with IT and Business application teams to secure Microsoft 365 and other line-of-business systems, including CRM and ERP
- Own identity, access, and data protection controls across business applications
- Manage third-party/vendor risk for business-critical SaaS
- 8+ years in information security, including 3+ years in a leadership role, preferably in all-remote or hybrid international organizations
- Track record running application security programs, ideally with CI/CD-integrated tooling and modern (AI-assisted) code review
- Hands-on experience with ISO 27001 and/or SOC 2, proven experience leading and successfully completing the audit, not just reading the standard
- Experience securing business applications (M365, CRM, ERP) and vendor risk management
- Ability to explain risk and trade-offs clearly to both engineers and executives
- Comfortable operating with a small team and prioritizing across competing demands
- Working knowledge of Kubernetes and cloud security; sovereign cloud experience is a plus
- 💻 Choice of work equipment (e.g., laptop, monitor, etc.)
- 🇬🇧 English classes (iTalki – $130 monthly)
- ⏰ Flexible schedule (we usually work between 09:00/10:00 and 18:00/19:00)
- 👶 Newborn bonus (€500 per child)
- 🧠 Patent remuneration
- 🌴 Paid leave
- 🧑💻 Remote work in locations without our offices
- Hybrid work in locations with offices (2 days in-office, 3 days remote)
Constructor fosters equal opportunity for people of all backgrounds and identities. We are led by a gender-balanced board committed to building a diverse and inclusive organisation where everyone can become their best self. We do not discriminate based on age, disability, gender identity, sexual orientation, ethnicity, race, religion or belief, parental and family status, or other protected characteristics. We welcome applications from women, men and non-binary candidates of all ethnicities and socio-economic backgrounds. We encourage people belonging to underrepresented groups to apply.
Skills Required
- 8+ years of experience in information security
- 3+ years of experience in a leadership role
- Experience running application security programs
- Experience integrating security tooling into CI/CD pipelines
- Experience with AI-assisted code review or AI coding security tools
- Hands-on experience with ISO 27001 and/or SOC 2
- Experience leading and completing security audits
- Experience securing business applications such as Microsoft 365, CRM, and ERP systems
- Experience with vendor risk management
- Ability to communicate security risks and trade-offs to engineers and executives
- Experience working with small teams and prioritizing competing demands
- Working knowledge of Kubernetes and cloud security
- Sovereign cloud experience
What We Do
Constructor group is a global institution dedicated to creating knowledge through science, education, and technology. Our integrated, self-sustainable ecosystem focuses on the five fundamental technology needs expected to contribute to solving the current challenges of the world: general intelligence, quantum technology, intelligent materials, hybrid reality, and life engineering.Our knowledge ecosystem combines extensive education offers covering the entire learning lifecycle from K-12 to post-graduate programs and courses for executives, highly efficient research capacities, and commercial operations for our technology breakthroughs.The Constructor ecosystem comprises Constructor University, a non-profit, research-oriented private university located in Bremen, Germany, and an institute in Schaffhausen.Several ventures market our technology innovations: Alemira and Learning focus on advanced solutions in Educational Technology, executive education, and consulting services. Rolos delivers a platform boosting research productivity and develops MI for robotics and driverless mobility. Capital and Start Garden further strengthen our ecosystem by offering funding and start-up incubation capacities.
