Odpovědnosti

Původní popisek.

Vulnerability Management: Triage, investigate, and prioritize application security findings based on actual risk and drive remediation with engineering teams.
Risk Assessment: Assess vulnerabilities and application designs based on exposure, exploitability, data sensitivity, blast radius, and business impact.
Threat Modeling: Identify security risks and design-level issues before applications and features are built.
Secure Code Review: Review application code, APIs, authentication/authorization, and business logic to identify vulnerabilities that automated tools may miss.
SAST/SCA & Security Tooling: Own and improve application security tooling such as Snyk, CodeQL, and Wiz Code, including signal quality and developer experience.
CI/CD Security: Build and maintain automated security checks and pipeline gates to identify issues before they reach production.

Ukázat vše (12)

O pozici / o projektu

Původní popisek.

You'd be joining a team that owns the security of the application code, dependencies, APIs, and development lifecycle behind Canvas, Mastery, and Parchment products used by tens of millions of students, instructors, and institutions. What we're actually measuring is risk reduction. Not findings filed, not scan coverage, not tickets closed. This shapes the job: a large part of it is forming a defensible view of how much risk something actually carries, driving that risk down, and handing whatever remains to our risk management program so the business can decide about it explicitly. We'd rather you correctly classify ten things and reduce the three that matter than route a thousand alerts Our security engineering team is organized into two domain-specialized branches, Application Security and Cloud Infrastructure Security, so that engineers develop genuine depth rather than shallow coverage of everything. You'd own the application domain and get very good at it. We've written down what this role owns and what it doesn't, because we think ambiguity about ownership is one of the main ways security teams become frustrating places to work. You'll work closely with product engineering teams.

Core engineering responsibilities

Risk classification and residual risk handoff: Determine what risk a finding or design actually represents in context: exposure, data sensitivity, exploitability, blast radius, business impact. Tool-assigned severity is an input, not an answer — a high CVSS score on an unreachable component may be low risk, and a medium score on a public endpoint handling student data may not be

Severity is our call and so is the framework we level against: Drive that risk down, and where it can't be reduced to an acceptable level, build the case for what remains: what the risk is, what was attempted, what's left, and what resolution would take

We don't accept risk ourselves, and we don't quietly carry it : see below for who does

Vulnerability management : triage, severity adjudication, and driving remediation to completion for findings from our scanning tooling. This means partnering with the owning engineering team, not filing a ticket and walking away

Compensating controls : when a vulnerability can't be directly remediated, design and implement a control that reduces the risk to an accepted level, and document the reasoning and expiry condition

False-positive adjudication : investigate findings, determine genuine exploitability in context, and suppress non-issues with recorded reasoning. We treat suppression as an engineering judgment that needs a written justification, not a way to clear a queue

CI/CD security automation : build and maintain the pipeline gates and checks that catch problems before they ship. We'd rather automate a class of issue than review for it forever

Security tooling : installation, configuration, integration, and data pipelines for the application security toolchain

Application security specialization

Threat modeling : work with product and engineering teams to find design-level problems before they're built

Secure code review : manual review for the logic and authorization flaws that scanners reliably miss

SAST/SCA pipeline : own our static analysis and dependency scanning (Snyk, CodeQL, Wiz Code) coverage, signal quality, and developer experience

Secure defaults and paved-road libraries : build the shared libraries and patterns that make the secure path the easy path

Developer enablement : training, documentation, office hours, and design consultation

Product partnership : see below

Bug bounty program : work with our offensive security engineer to aid in researcher communication and triage flow

Technical specification review : review application specs against our security review rubric, escalating high-risk and novel designs to our Principal engineer or manager

Detail pracovní nabídky

Online nábor
Jazyk náboru: Maďarština&Angličtina
Ihned
Hybridní práce

Zaměstnavatel nabízí následující model hybridní práce:

We are flexible with this.

Flexibilní pracovní doba

Metodika práce

Agile management Scrum, Kanban, Agile
Issue tracking tool Jira
Knowledge repository Confluence, GitHub, GitBook
Virtualization Docker, Kubernetes
Network virtualization AWS VPC
Provisioning Terraform
Cloud infrastructure AWS
Operating system macOS
Security Okta, IAM, JWT/TLS via API Gateway, Snyk, Wiz, Invicti, Bugcrowd
Application stack Python, https://jobeax.com/link/JSd7UYCSg572jJDY, TypeScript, React, NestJS, Ruby on Rails
Version control system GIT, Github, a bit of Gerrit
Databases PostgreSQL, AWS Aurora PostgreSQL, DynamoDB, Snowflake, OpenSearch, Redis

Výhody v kanceláři

Free coffee
Bike parking
Playroom
Free snacks
Free beverages
Free lunch
In-house trainings
In-house hack days
Modern office
Startup atmosphere
No dress code

Výhody

Medicare Private Healthcare with Hospital Package
Employee Assistance Program
SZEP Card
Employee Wellness Program

Senior Application Security Engineer @ Instructure Hungary Ltd

Začněte e-mailem