Director, Security Engineering

This is a fully remote position, open to applicants in United States.

📋 Description

• Take charge of how Instructure develops and operates securely.

• Oversee product security integrated within R&D teams.

• Direct cloud and infrastructure security initiatives across AWS.

• Manage AI security concerning AI features, agents, and services.

• Establish security architecture standards, vulnerability management, and edge security protocols.

• Lead threat modeling efforts, design evaluations, and release checkpoints.

• Authorize standard product launches and oversee penetration testing and bug bounty submissions.

• Administer IAM, AWS guardrails, infrastructure as code, patch policies, secrets rotation, and access for privileged and non-human entities.

• Own WAF standards and approve modifications to WAF rules and patch scheduling.

• Define controls to prevent prompt injection, excessive agent permissions, tool misuse, data leakage, and unauthorized access via RAG and connectors.

• Establish intake and risk assessment processes for third-party AI services, and manage shadow AI risks with GRC.

• Incorporate AI risks into threat modeling, design assessments, and release gates.

• Collaborate with the Security Architect on AI reference patterns and with GRC regarding AI governance and risk management.

• Establish security architecture and design benchmarks.

• Oversee vulnerability management utilizing Wiz across both code and cloud environments.

• Define secure SDLC standards and release criteria, including code-scanning checkpoints.

• Assist in customer security evaluations as the technical authority.

• Fulfill Security Engineering commitments and monitor Engineering commitments with the VP of Engineering.

• Recruit, lead, and develop the team.

• Draft job descriptions for team positions.

• Report on vulnerability SLA performance monthly and product security metrics quarterly.

• Manage Security Engineering expenditures to align with budgetary constraints.

• Ensure team members have written development plans reviewed quarterly.

• Report directly to the CISO.

⛳️ Requirements

• Over 10 years of experience in security engineering.

• More than 5 years in leadership roles within security teams.

• Proven experience leading product security and cloud security teams.

• Hands-on expertise in cloud environments.

• Solid understanding of AI and LLM security vulnerabilities, including prompt injection, agent exploitation, and data leakage.

• Familiarity with OWASP Top 10 for LLM Applications and NIST AI RMF.

• Experience in influencing senior Engineering leaders regarding design and risk trade-offs.

• Background in SaaS environments.

• Ideally, experience managing regulated data such as education records under FERPA and COPPA.

• Must successfully pass a background check.

• Candidates may need to verify their legal name, current physical location, valid contact number, and residential address in compliance with local data privacy regulations.

🏝️ Benefits

• Competitive salary.

• Ownership program available for all full-time employees.

• Flexible work culture.

• Generous time off, including local holidays and an annual “Dim the Lights” period.

• Comprehensive wellness programs and mental health support.

• Access to learning and development resources.

• Professional development tools.

• Tuition reimbursement.

• Necessary technology and tools to excel in your work.

• Motivosity employee recognition program.

• An inclusive and supportive workplace culture.