Senior Application Security Engineer
Posted 8
views
Summary
Senior Application Security Engineer at Instructure who owns the security of the application domain day to day: vulnerability triage and remediation, SAST/SCA pipeline coverage, CI/CD security automation, threat modeling, secure code review, and developer enablement, plus bug bounty triage and incident escalation. Remote, hybrid, or in-office work is offered.
- Risk classification and residual risk handoff for application domain
- Severity adjudication and risk framework management
- Vulnerability management including triage and remediation partnership
- Design and implementation of compensating controls for vulnerabilities
- False-positive adjudication with documented reasoning
- CI/CD security automation including pipeline gates and checks
- Security tooling installation, configuration, integration, and data pipeline management
- Threat modeling with product and engineering teams
- Secure code review for logic and authorization flaws
- Ownership of SAST/SCA pipeline coverage, signal quality, and developer experience
- Development of secure defaults and paved-road libraries
- Developer enablement through training, documentation, office hours, and design consultation
- Bug bounty program support including researcher communication and triage
- Technical specification review against security review rubric
- Product partnership including risk reviews and risk framing for product management
- Major incident escalation as subject-matter expert on demand
- Competitive compensation
- Participation in ownership program for full-time employees
- Flexible work culture with remote, hybrid, and in-office collaboration
- Generous time off including local holidays and annual "Dim the Lights" period
- Comprehensive wellness programs and mental health support
- Learning and development resources including professional development tools and tuition reimbursement
- Provision of technology and tools needed for work
- Motivosity employee recognition program