Senior Application Security Engineer

Jelentkezem a cégnél

Cég neve

Instructure Hungary Kft.
Munkavégzés helye

Távmunka / Remote
Profession Prémium

Nézd meg, mennyire felelsz meg ennek az állásnak. Mennyire passzolok?

Munkaidő, foglalkoztatás jellege
- Alkalmazotti jogviszony
- Általános munkarend
Elvárt technológiák
- SECURITY
Elvárások
- Angol középfok
- Nem kell tapasztalat
- Középiskola

Állás elmentve

A hirdetést eltávolítottuk a mentett állásai közül.

A hirdetés adatait sikeresen elküldte az email címére.

Responsibilities

Owning the security of the application code, dependencies, APIs, and development lifecycle behind Canvas, Mastery, and Parchment products
Forming a defensible view of how much risk something actually carries, driving that risk down, and handing whatever remains to the risk management program
Determining what risk a finding or design actually represents in context: exposure, data sensitivity, exploitability, blast radius, business impact
Driving risk down and building the case for what remains when it can't be reduced to an acceptable level
Triage, severity adjudication, and driving remediation to completion for findings from scanning tooling by partnering with the owning engineering team
Designing and implementing compensating controls when a vulnerability can't be directly remediated, and documenting the reasoning and expiry condition
Investigating findings, determining genuine exploitability in context, and suppressing non-issues with recorded reasoning
Building and maintaining the pipeline gates and checks that catch problems before they ship
Installing, configuring, integrating, and managing data pipelines for the application security toolchain
Working with product and engineering teams to find design-level problems before they're built through threat modeling
Performing manual secure code review for logic and authorization flaws that scanners miss
Owning static analysis and dependency scanning (Snyk, CodeQL, Wiz Code) coverage, signal quality, and developer experience
Building shared libraries and patterns that make the secure path the easy path
Providing developer enablement through training, documentation, office hours, and design consultation
Working with the offensive security engineer to aid in researcher communication and triage flow for the bug bounty program
Reviewing application specs against security review rubric and escalating high-risk and novel designs to Principal engineer or manager
Collaborating day-to-day with development teams writing code and shipping fixes
Conducting recurring risk reviews with product leadership and framing risk in specification review feedback
Being the person product managers can ask about real risk and provide straight, non-alarmist answers
Participating in a security on-call rotation for major incident escalation as a subject-matter expert when needed

Requirements

Experience in application security engineering
Ability to classify risk accurately and drive risk reduction
Experience with vulnerability management and remediation
Skill in designing and implementing compensating controls
Ability to adjudicate false positives with written justification
Experience building CI/CD security automation
Knowledge of security tooling installation, configuration, integration, and data pipelines
Experience with threat modeling and secure code review
Familiarity with static analysis and dependency scanning tools such as Snyk, CodeQL, Wiz Code
Ability to build secure defaults and paved-road libraries
Capability to enable developers through training, documentation, and consultation
Experience working with bug bounty programs
Skill in reviewing technical specifications against security criteria
Ability to communicate security risk effectively to both technical and non-technical audiences
Willingness to participate in security on-call rotation for major incident escalation

What we offer

Competitive compensation, plus participation in ownership program
Flexible work culture with remote, hybrid and in-office collaboration spaces varying by role, team and location
Generous time off including local holidays and annual “Dim the Lights” period in late December
Comprehensive wellness programs and mental health support
Learning and development resources including professional development tools and tuition reimbursement
Technology and tools needed to do best work
Motivosity employee recognition program
A culture rooted in inclusivity, support, and meaningful connection

Company info

Instructure creates intuitive products that simplify learning and personal development, facilitate meaningful relationships, and inspire people to go further in their education and careers.