Director, Security Engineering

Owns how Instructure builds and runs its software securely as Director of Security Engineering, reporting to the CISO and working remotely in the US. Three teams report into the role: product security, whose engineers sit inside R&D, AWS cloud and infrastructure security, and AI security. Security architecture standards, vulnerability management and edge security are also part of its remit.

On product security the director runs threat modelling, design reviews and the release gate, approves standard launches and takes in pentest and bug bounty findings. On cloud security the remit covers IAM, AWS guardrails, infrastructure as code, patch policy, secrets rotation, privileged and non-human access, and the WAF standard. For AI, the director sets standards for the AI features, agents and services Instructure builds or integrates, defines controls against prompt injection, excessive agent permissions, data leakage and misuse of RAG and connectors, and reviews third-party AI services and shadow AI with GRC. The role also owns vulnerability management in Wiz with SLAs by team, sets secure SDLC standards and code scanning gates, supports customer security reviews, manages budget and delivery commitments, and hires and develops the team.

Instructure wants ten years in security engineering, five of them leading security teams, experience running product and cloud security teams with hands-on cloud depth, practical knowledge of LLM security risks and frameworks such as the OWASP Top 10 for LLM Applications and NIST AI RMF, and a record of influencing senior engineering leaders. SaaS experience with regulated data such as education records under FERPA or COPPA is a plus.