{"id":1036498,"url":"https://alion.io/job/instructure-senior-application-security-engineer","title":"Senior Application Security Engineer","company":{"id":6996,"name":"Instructure","domain":"instructure.com","url":"https://alion.io/company/instructure","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":92,"open_postings":3,"ghost_share":0,"stale_share":0.333,"repost_share":0,"time_to_fill_p50_days":43,"computed_at":"2026-11-03T05:54:40Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Budapest, Hungary"],"countries":["HU"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":1750000,"max":2000000,"currency":"HUF","period":"month","gross":null,"usd_annual":74304},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"CodeQL","optional":false},{"name":"CVSS","optional":false},{"name":"Snyk","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Wiz","optional":false}],"status":"live","first_seen_at":"2026-09-18T16:06:16Z","employer_posted_date":"2026-09-18","last_verified_at":"2026-11-03T16:37:48Z","board_verified":true,"closed_at":null,"days_open":46,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":46},"description":"At Instructure, we believe in the power of people to grow and succeed throughout their lives. Our goal is to amplify that power by creating intuitive products that simplify learning and personal development, facilitate meaningful relationships, and inspire people to go further in their education and careers.\nWe do this by giving smart, creative, passionate people opportunities to create awesome. And that's where you come in:\nWe're growing our security engineering team and building out a dedicated Application Security branch. You'd be joining a team that owns the security of the application code, dependencies, APIs, and development lifecycle behind Canvas, Mastery, and Parchment products used by tens of millions of students, instructors, and institutions.\nWhat we're actually measuring is risk reduction. Not findings filed, not scan coverage, not tickets closed. This shapes the job: a large part of it is forming a defensible view of how much risk something actually carries, driving that risk down, and handing whatever remains to our risk management program so the business can decide about it explicitly. We'd rather you correctly classify ten things and reduce the three that matter than route a thousand alerts.\nOur security engineering team is organized into two domain-specialized branches, Application Security and Cloud Infrastructure Security, so that engineers develop genuine depth rather than shallow coverage of everything. You'd own the application domain and get very good at it. We've written down what this role owns and what it doesn't, because we think ambiguity about ownership is one of the main ways security teams become frustrating places to work.\nYou'll work closely with product engineering teams. Many of the security outcomes we care about are achieved by developers, not by security engineers, so this role is measured substantially by whether you make it easier for developers to build secure software, not by how many findings you file.\nCore engineering responsibilities\nThese are the foundation of every engineering role on our security team. You'd own them for the application domain: code, dependencies, APIs, and the SDLC:\nRisk classification and residual risk handoff: Determine what risk a finding or design actually represents in context: exposure, data sensitivity, exploitability, blast radius, business impact. Tool-assigned severity is an input, not an answer - a high CVSS score on an unreachable component may be low risk, and a medium score on a public endpoint handling student data may not be.\nSeverity is our call and so is the framework we level against: Drive that risk down, and where it can't be reduced to an acceptable level, build the case for what remains: what the risk is, what was attempted, what's left, and what resolution would take.\nWe don't accept risk ourselves, and we don't quietly carry it: see below for who does.\nVulnerability management: triage, severity adjudication, and driving remediation to completion for findings from our scanning tooling. This means partnering with the owning engineering team, not filing a ticket and walking away.\nCompensating controls: when a vulnerability can't be directly remediated, design and implement a control that reduces the risk to an accepted level, and document the reasoning and expiry condition.\nFalse-positive adjudication: investigate findings, determine genuine exploitability in context, and suppress non-issues with recorded reasoning. We treat suppression as an engineering judgment that needs a written justification, not a way to clear a queue.\nCI/CD security automation: build and maintain the pipeline gates and checks that catch problems before they ship. We'd rather automate a class of issue than review for it forever.\nSecurity tooling: installation, configuration, integration, and data pipelines for the application security toolchain.\nApplication security specialization\nThreat modeling: work with product and engineering teams to find design-level problems before they're built.\nSecure code review: manual review for the logic and authorization flaws that scanners reliably miss.\nSAST/SCA pipeline: own our static analysis and dependency scanning (Snyk, CodeQL, Wiz Code) coverage, signal quality, and developer experience.\nSecure defaults and paved-road libraries: build the shared libraries and patterns that make the secure path the easy path.\nDeveloper enablement: training, documentation, office hours, and design consultation.\nProduct partnership: see below.\nBug bounty program: work with our offensive security engineer to aid in researcher communication and triage flow.\nTechnical specification review: review application specs against our security review rubric, escalating high-risk and novel designs to our Principal engineer or manager.\nProduct partnership\nThis role has two audiences, and the second one is often missing on security teams.\nDevelopment teams are the day-to-day collaboration the people writing the code and shipping the fixes. But product management needs to see the risk carried by their own products in terms they can act on.\nProduct managers make prioritization calls constantly. They should be making them with visibilityinto security risk rather than discovering it afterward. In practice that means recurring risk reviews with product leadership for your area, risk framing in your specification review feedback, and being the person a product manager can ask \"how risky is this, really?\" and get a straight, non-alarmist answer.\nThis is a different skill from developer collaboration: the audience is potentially less technical, the time horizon is longer, and the currency is business impact rather than remediation detail. If translating technical risk for a non-engineering audience is something you enjoy - or want to get good at - this part of the role has real room in it.\nMajor incident escalation\nWe have a SOC that handles the overwhelming majority of alerts plus L1 and L2 triage. You will be on a security on-call rotation but you wouldn't be doing routine alert triage.\nBut when a major incident escalates past L2 and resolution needs deep expertise in either the tooling that produced the alert or the application systems that are impacted, you may be pulled in as a subject-matter expert. This is limited to major incidents only, expertise on demand rather than first response. SecOps runs the incident, you're there for the depth of expertise not the process.\nGet in on all the awesome at Instructure!\nWe offer competitive, meaningful benefits in every country where we operate. While they vary by location, here's a general idea of what you can expect:\nCompetitive compensation, plus all full-time employees participate in our ownership program - because everyone should have a stake in our success.\n\nFlexible work culture. Our remote, hybrid and in-office collaboration spaces vary by role, team and location.\n\nGenerous time off, including local holidays and our annual “Dim the Lights” period in late December, when teams are encouraged to step back and recharge based on departmental needs.\n\nComprehensive wellness programs and mental health support\n\nLearning and development resources, including professional development tools and tuition reimbursement, to support your growth\n\nThe technology and tools you need to do your best work\n\nMotivosity employee recognition program\n\nA culture rooted in inclusivity, support, and meaningful connection\n\nWe believe in hiring great people and treating them right. The more diverse we are, the better our ideas and outcomes.\nInstructure is an Equal Opportunity Employer. We comply with applicable employment and anti-discrimination laws in every country where we operate.\nAll employees must pass a background check as part of the hiring process. To help protect our teams and systems, we’ve implemented identity verification measures. Candidates may be asked to verify their legal name, current physical location, and provide a valid contact number and residential address, in accordance with local data privacy laws.\nAny attempt to misrepresent personal or professional information will result in disqualification.","description_format":"text","description_chars":8153,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Flexible schedule","Professional development","Wellness"],"hiring_locations":[{"name":"Hungary","iso":"HU","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","EdTech Platforms","E-learning","Learning Management Systems"],"lifecycle":[{"event":"open","at":"2026-09-18T16:30:21Z"}],"visa":[],"liveness":{"score":47,"band":"ok","label":"Likely open","p_open":1,"p_active":0.854,"p_room":0.55,"age_days":45,"expected_fill_days":43,"reasons":["conf:3","velocity","win:tail"],"computed_at":"2026-11-03T05:54:40Z"},"pay":{"stated_usd_annual":74304,"is_top_pay":false},"html_url":"https://alion.io/job/instructure-senior-application-security-engineer","json_url":"https://alion.io/job/instructure-senior-application-security-engineer.json","meta":{"generated_at":"2026-11-03T21:19:03Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":393,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-04T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6996},"rest":"https://alion.io/mcp/rest/get_company?id=6996"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Finstructure-senior-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Finstructure-senior-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Finstructure-senior-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/instructure-senior-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Finstructure-senior-application-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":1036498}},{"tool":"search_jobs","arguments":{"company":"instructure.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":1036498},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}