Description
At Instructure, we believe in the power of people to grow and succeed throughout their lives.
We're growing our security engineering team and building out a dedicated Application Security branch. You'd be joining a team that owns the security of the application code, dependencies, APIs, and development lifecycle behind Canvas, Mastery, and Parchment products used by tens of millions of students, instructors, and institutions.
What we're actually measuring is risk reduction. Not findings filed, not scan coverage, not tickets closed. This shapes the job: a large part of it is forming a defensible view of how much risk something actually carries, driving that risk down, and handing whatever remains to our risk management program so the business can decide about it explicitly.
Core Engineering Responsibilities These are the foundation of every engineering role on our security team. You'd own them for the application domain: code, dependencies, APIs, and the SDLC:
- Risk classification and residual risk handoff: Determine what risk a finding or design actually represents in context: exposure, data sensitivity, exploitability, blast radius, business impact.
- Vulnerability management: triage, severity adjudication, and driving remediation to completion for findings from our scanning tooling.
- Compensating controls: when a vulnerability can't be directly remediated, design and implement a control that reduces the risk to an accepted level, and document the reasoning and expiry condition.
- False-positive adjudication: investigate findings, determine genuine exploitability in context, and suppress non-issues with recorded reasoning.
- CI/CD security automation: build and maintain the pipeline gates and checks that catch problems before they ship.
- Security tooling: installation, configuration, integration, and data pipelines for the application security toolchain.
Application Security Specialization
- Threat modeling: work with product and engineering teams to find design-level problems before they're built.
- Secure code review: manual review for the logic and authorization flaws that scanners reliably miss.
- SAST/SCA pipeline: own our static analysis and dependency scanning (Snyk, CodeQL, Wiz Code) coverage, signal quality, and developer experience.
- Secure defaults and paved-road libraries: build the shared libraries and patterns that make the secure path the easy path.
- Developer enablement: training, documentation, office hours, and design consultation.
- Product partnership: see below.
- Bug bounty program: work with our offensive security engineer to aid in researcher communication and triage flow.
- Technical specification review: review application specs against our security review rubric, escalating high-risk and novel designs to our Principal engineer or manager.
Product Partnership This role has two audiences, and the second one is often missing on security teams. Development teams are the day-to-day collaboration the people writing the code and shipping the fixes. But product management needs to see the risk carried by their own products in terms they can act on.
Major Incident Escalation We have a SOC that handles the overwhelming majority of alerts plus L1 and L2 triage. You will be on a security on-call rotation but you wouldn't be doing routine alert triage.
Benefits
- Competitive compensation, plus all full-time employees participate in our ownership program
- Flexible work culture
- Generous time off, including local holidays and our annual “Dim the Lights” period
- Comprehensive wellness programs and mental health support
- Learning and development resources, including professional development tools and tuition reimbursement
- The technology and tools you need to do your best work
- Motivosity employee recognition program