Senior Application Security Engineer
Posted Updated
Summary
Senior Application Security Engineer at Instructure's Hungarian entity, owning application-security programs day to day: vulnerability triage and remediation, SAST/SCA and CI/CD security automation, threat modeling, secure code review, and developer enablement. Flexible remote, hybrid, or in-office work.
- Risk classification and residual risk handoff
- Severity adjudication and risk framework management
- Vulnerability management including triage and remediation driving
- Design and implementation of compensating controls
- False-positive adjudication with written justification
- CI/CD security automation development and maintenance
- Security tooling installation, configuration, integration, and data pipeline management
- Threat modeling with product and engineering teams
- Secure code review for logic and authorization flaws
- SAST/SCA pipeline ownership including static analysis and dependency scanning
- Development of secure defaults and paved-road libraries
- Developer enablement through training, documentation, office hours, and design consultation
- Bug bounty program support including researcher communication and triage flow
- Technical specification review against security review rubric
- Product partnership including risk reviews and risk framing for product leadership
- Major incident escalation as subject-matter expert
- Competitive compensation
- Participation in ownership program for full-time employees
- Flexible work culture with remote, hybrid, and in-office collaboration spaces
- Generous time off including local holidays and annual "Dim the Lights" period
- Comprehensive wellness programs and mental health support
- Learning and development resources including professional development tools and tuition reimbursement
- Provision of technology and tools needed for work
- Motivosity employee recognition program