Senior Application Security Engineer

We're growing our security engineering team and building out a dedicated Application Security branch. You'd be joining a team that owns the security of the application code, dependencies, APIs, and development lifecycle behind Canvas, Mastery, and Parchment products used by tens of millions of students, instructors, and institutions.

What we're actually measuring is risk reduction. Not findings filed, not scan coverage, not tickets closed. This shapes the job: a large part of it is forming a defensible view of how much risk something actually carries, driving that risk down, and handing whatever remains to our risk management program so the business can decide about it explicitly. We'd rather you correctly classify ten things and reduce the three that matter than route a thousand alerts.

Our security engineering team is organized into two domain-specialized branches, Application Security and Cloud Infrastructure Security, so that engineers develop genuine depth rather than shallow coverage of everything. You'd own the application domain and get very good at it. We've written down what this role owns and what it doesn't, because we think ambiguity about ownership is one of the main ways security teams become frustrating places to work.