What's Happening?
Instructure, an educational technology company known for its Canvas Learning Management System, is actively seeking a Director of Security Engineering. This pivotal role will oversee three core security functions: product security, cloud and infrastructure
security across AWS, and AI security. The Director will be responsible for setting security standards for AI features, agents, and services, defining controls for risks such as prompt injection, excessive agent permissions, data leakage, and unauthorized access through Retrieval-Augmented Generation (RAG) and connectors. Additionally, the role involves managing security architecture standards, vulnerability management, and edge security, reporting directly to the CISO. The ideal candidate will possess over 10 years of experience in security engineering, with at least 5 years in a leadership capacity, and practical knowledge of AI and Large Language Model (LLM) security risks, including familiarity with frameworks like OWASP Top 10 for LLM Applications and NIST AI RMF. The position also requires experience in SaaS environments, particularly with regulated data such as education records (FERPA, COPPA).
Why It's Important?
This hiring initiative underscores Instructure's commitment to safeguarding its educational platforms and the sensitive data they handle, especially as AI integration becomes more prevalent. The focus on AI security is critical given the emerging threats associated with LLMs and AI-driven features, which could impact the integrity and privacy of educational records. By proactively addressing these advanced security challenges, Instructure aims to maintain trust among its users—students, educators, and institutions—and comply with stringent data privacy regulations like FERPA and COPPA. A robust security posture is essential for the continued adoption and reliability of its products, such as Canvas, which are central to learning and personal development. The investment in a high-level security engineering director reflects a broader industry trend where technology companies are prioritizing specialized expertise to combat sophisticated cyber threats and ensure the ethical and secure deployment of AI technologies.
What's Next?
The successful candidate will be instrumental in shaping Instructure's security roadmap, influencing senior engineering leaders on design and risk trade-offs, and building out the security engineering organization. This will involve leading threat modeling, design reviews, and release gates for new features, including AI functionalities. The Director will also be responsible for managing vulnerability remediation, ensuring compliance with AWS controls, and supporting customer security reviews. The ongoing development and implementation of AI security standards and controls will be a continuous process, adapting to new threats and technological advancements. Instructure's proactive approach to security, particularly in the AI domain, is likely to set a precedent for other educational technology providers, potentially leading to industry-wide improvements in data protection and AI governance within the education sector.
Beyond the Headlines
The creation of a dedicated Director of Security Engineering role with a strong emphasis on AI security highlights the growing recognition of AI's unique vulnerabilities and the need for specialized expertise to mitigate them. This move by Instructure reflects a broader societal concern about the ethical implications and potential misuse of AI, particularly in sensitive areas like education. The focus on frameworks like OWASP Top 10 for LLM Applications and NIST AI RMF indicates a commitment to industry best practices and regulatory alignment. This proactive stance not only protects Instructure's users but also contributes to the development of more secure and trustworthy AI systems in the educational technology landscape. The long-term implications include fostering greater confidence in AI-powered learning tools and potentially influencing future policy and regulatory discussions around AI safety and data privacy in education.
