Director, Security Engineering

Instructure, Inc. • ,

2d • $200,000 - $225,000

About The Position

The Director, Security Engineering owns how Instructure builds and runs securely. The role leads product security embedded in R&D teams, cloud and infrastructure security across AWS, and AI security. It also owns security architecture standards, vulnerability management, and edge security, and reports to the CISO.

The Director leads product security reviews and release gates; cloud security practices and standards; and security standards and risk controls for AI features, agents, and services. The role works with the Security Architect, Security Platform and Vulnerability Management Lead, GRC, Engineering leaders, and the VP of Engineering to establish standards, manage risk, deliver commitments, and support customer security reviews.

The Director hires, leads, and develops the Security Engineering team, manages its spend to budget, and ensures commitments and staffing plans are delivered on schedule. Success includes timely security design reviews, reported and escalated vulnerability SLAs, delivery of commitments, quarterly reporting on product security coverage and remediation, and written development plans for every team member.

Requirements

• 10+ years of experience in security engineering.
• 5+ years of experience leading security teams.
• Experience leading product security and cloud security teams, with hands-on depth in cloud environments.
• Practical knowledge of AI and LLM security risks, including prompt injection, agent abuse, and data leakage.
• Knowledge of frameworks such as OWASP Top 10 for LLM Applications and NIST AI RMF.
• Experience influencing senior Engineering leaders on design and risk trade-offs.
• Experience in SaaS.

Nice To Haves

• Experience handling regulated data such as education records, including FERPA and COPPA.

Responsibilities

• Lead product security, including threat modeling, design reviews, and release gates, with the team embedded in R&D teams on a dotted line.
• Approve standard product launches and own penetration test and bug bounty intake.
• Lead cloud and infrastructure security, including IAM, AWS guardrails, infrastructure as code, patch policy, secrets rotation, and privileged and non-human access.
• Own the WAF standard and approve WAF rule changes and patch window changes.
• Set security standards for AI features, agents, and AI services that Instructure builds or integrates.
• Define controls for prompt injection, excessive agent permissions and tool abuse, data leakage, and unauthorized access through RAG and connectors.
• Set intake and risk review for third-party AI services and manage shadow AI risk with GRC.
• Include AI-specific risks in threat modeling, design reviews, and release gates.
• Work with the Security Architect on AI reference patterns and with GRC on AI governance and risk.
• Set security architecture and design standards, working through the Security Architect.
• Own vulnerability management, including Wiz across code and cloud, team SLAs, exceptions, and disputes.
• Set secure SDLC standards and release criteria, including code-scanning gates, with the Security Platform and Vulnerability Management Lead.
• Support customer security reviews as the technical expert, working with GRC.
• Deliver Security Engineering commitments in the plan and track Engineering commitments with the VP of Engineering.
• Hire, lead, and grow the team, and write job descriptions for team roles.
• Ensure in-scope features, including AI features, receive security design reviews before release.
• Report vulnerability SLA performance to Engineering leaders monthly and escalate overdue items to the owning VP.
• Ensure Security Engineering commitments and open-role hiring are completed on planned dates, and manage Security Engineering spend to budget.
• Report product security coverage, remediation speed, and escaped defects quarterly.
• Ensure every team member has a written development plan reviewed quarterly.

Benefits

• Competitive compensation.
• Ownership program participation for all full-time employees.
• Flexible work culture, with remote, hybrid, and in-office collaboration spaces varying by role, team, and location.
• Generous time off, including local holidays and the annual “Dim the Lights” period in late December, based on departmental needs.
• Comprehensive wellness programs and mental health support.
• Learning and development resources, including professional development tools and tuition reimbursement.
• Technology and tools needed to do the work.
• Motivosity employee recognition program.
• A culture rooted in inclusivity, support, and meaningful connection.

What This Job Offers

• Job Type: Full-time
• Career Level: Director
• Education Level: No Education Listed