# Director, Security Engineering at Instructure > Remote · United States · Director+ · Security · open. Source: https://alderhq.app/jobs/ashby%3Ainstructure%3Ab72693ca-5513-4afc-b07d-d0d6d6ddb5fe (read 2026-11-05). ## Facts (observed) - Company: [Instructure](https://alderhq.app/companies/instructure) - Location text: US-REMOTE - Where it can be done from (inferred): Remote · United States (evidence: "Location: US-REMOTE") - Posted: 2026-11-03 (2 days ago) - First seen by alder: 2026-11-03 · last verified: 2026-11-04 - Reposted: 0 times · edited: 0 times - Apply on the employer's site: https://jobs.ashbyhq.com/instructure/b72693ca-5513-4afc-b07d-d0d6d6ddb5fe - Skills listed (inferred): AWS, LLMs ## Pay and sponsorship - Posted pay: $200k–$225k per year (from the listing's pay field) - Market band for similar posted roles (United States, n 63): p25 $223k, median $260k, p75 $311k ## Description (the employer's text) At Instructure, we believe in the power of people to grow and succeed throughout their lives. Our goal is to amplify that power by creating intuitive products that simplify learning and personal development, facilitate meaningful relationships, and inspire people to go further in their education and careers. We do this by giving smart, creative, passionate people opportunities to create awesome. And that's where you come in: ### Job Description The Director, Security Engineering owns how Instructure builds and runs securely. The role leads three core functions: product security, embedded in R&D teams, cloud and infrastructure security across AWS, and AI security. It also owns security architecture standards, vulnerability management, and edge security. Reports to the CISO. Responsibilities: ### Product security Lead product security: threat modeling, design review, and the release gate. The team works inside R&D teams on a dotted line. Approve standard product launches and own pen test and bug bounty intake. ### Cloud and infrastructure security Lead cloud and infrastructure security: IAM, AWS guardrails, infrastructure as code, patch policy, secrets rotation, and privileged and non-human access. Own the WAF standard and approve WAF rule changes and patch window changes ### AI security Lead AI security: set security standards for AI features, agents, and AI services that Instructure builds or integrates. Define controls for prompt injection, excessive agent permissions and tool abuse, data leakage, and unauthorized access through RAG and connectors. Set intake and risk review for third-party AI services, and manage shadow AI risk with GRC. Include AI-specific risks in threat modeling, design review, and the release gate. Work with the Security Architect on AI reference patterns, and with GRC on AI governance and risk. Architecture, vulnerability management, and delivery Set security architecture and design standards, working through the Security Architect. Own vulnerability management: Wiz across code and cloud, SLAs by team, exceptions, and disputes. Set secure SDLC standards and release criteria, including code scanning gates, with the Security Platform and Vulnerability Management Lead. Support customer security reviews as the technical expert, working with GRC. Deliver the Security Engineering commitments in the plan, and track Engineering commitments with the VP of Engineering. Hire, lead, and grow the team, and write job descriptions for the team's roles. ### Success measures New in-scope features, including AI features, get a security design review before release. Vulnerability SLA performance reported to Engineering leaders monthly, with overdue items escalated to the owning VP. Security Engineering commitments delivered on the committed date. Open Security Engineering roles filled on planned dates. Security Engineering spend managed to budget. Product security coverage, remediation speed, and escaped defects reported quarterly. Every team member has a written development plan, reviewed quarterly. Qualifications 10+ years in security engineering, including 5+ years leading security teams. Has led product security and cloud security teams, with hands-on depth in cloud environments. Practical knowledge of AI and LLM security risks, such as prompt injection, agent abuse, and data leakage, and of frameworks such as OWASP Top 10 for LLM Applications and NIST AI RMF. Has influenced senior Engineering leaders on design and risk trade-offs. Experience in SaaS, ideally handling regulated data such as education records (FERPA, COPPA). ### Get in on all the awesome at Instructure! We offer competitive, meaningful benefits in every country where we operate. While they vary by location, here's a general idea of what you can expect: Competitive compensation, plus all full-time employees participate in our ownership program - because everyone should have a stake in our success. Flexible work culture. Our remote, hybrid and in-office collaboration spaces vary by role, team and location. Generous time off, including local holidays and our annual “Dim the Lights” period in late December, when teams are encouraged to step back and recharge based on departmental needs. --- Data: alder (https://alderhq.app). Cite https://alderhq.app/jobs/ashby%3Ainstructure%3Ab72693ca-5513-4afc-b07d-d0d6d6ddb5fe and the date you read it. Observed facts come from the employer's own listing; location reach, level, family and skills are inferences.