Security Engineer, Instructure

• Ability to work effectively on a remote team in a collaborative, fast-paced, and dynamic environment
• Strong communication skills, with the ability to convey technical concepts to both technical and non-technical stakeholders
• A polite, professional demeanor and a commitment to fostering a positive and respectful workplace
• Excellent problem-solving and critical-thinking skills
• Willingness to learn on the job and work outside of your comfort zone
• 3+ years of experience in a security engineering role or similar application engineering role
• Proficiency in securing cloud environments (AWS)
• Strong familiarity with DevSecOps and CI/CD pipeline security
• Hands-on experience with security tools such as vulnerability scanners and code analysis tools
• Understanding of OWASP Top 10 and overall secure application development principals
• Working understanding of networking, encryption, authentication protocols, and secure application development

Desirable

• As a key contributor to the Security organization, you'll be focused on engineering initiatives across all of Instructure's products and services
• As a Security Engineer, you will be responsible for designing, implementing, and maintaining security tooling to protect our SaaS platform
• You will also work closely with cross-functional teams to identify and address vulnerabilities, implement best practices, and ensure compliance with industry standards
• This role is critical in upholding the trust of our customers and partners
• Infrastructure Security
• Ensure secure configurations of cloud environments (e.g., AWS)
• Develop and maintain infrastructure-as-code (IaC) security practices
• Design, implement, deploy, and maintain security tooling
• Oversight and management of CNAPP platforms
• Responsible for deployment, management, and maintenance of zerotrust platform(s) and supporting an overall zerotrust philosophy architecture and culture
• Using static code analysis, dependency vulnerability scanning tools (Snyk) to identify and remediate vulnerabilities in application code
• Management of CICD pipeline controls using Git (Github Actions) for enforcement of security controls
• Collaborate with developers to identify and mitigate vulnerabilities in the software development lifecycle (SDLC)
• Perform code reviews and provide guidance on secure coding practices
• Manage third-party dependency packages and container images for security and patching processes
• Perform vulnerability prioritization analysis based on severity and impact
• Perform testing and validation application vulnerability patches
• Help build, maintain, and improve Security Orchestration and Automated Response (SOAR) practices to auto-remeidate and enrich security events
• Responsible for building security altering based on relevant Indicators of Compromise (IoC) using log aggregation tools (Splunk, Observe, Sumologic)
• Activity participate in investigations and incident response activities, including being part of the incident response team, investigating alerts, and working with cross functional teams to resolve any active attacks or potential threats