Enterprise Security Manager

The Security Group protects Canva systems and data from information security threats across Application Security, Risk Management, Enterprise Security, and Threat Detection and Response. The Internal Systems Security team (ISS) helps secure Canva's internal endpoints, networks, systems and data, including device posture, secure credentials and SaaS applications. The role manages a team of security engineers and owns the internal security strategy, balancing security, compliance and user experience. Candidates will be assessed on AI coding, security review and System Design skills during the interview process. Interviews are conducted virtually.

Responsibilities

Manage a team of security engineers who perform threat modelling, security tool rollouts, building internal security services, and partnering with other teams on security strategy; Own the strategy for internal security at Canva, balancing security, compliance and developer experience; Coach and develop engineers with regular, practical feedback; Own the team's ways of working, including sprint planning, stand-ups and retrospectives; Work collaboratively with partner groups such as IT, Sales, Customer Support and others to build security improvements that scale; Drive internal adoption of the team's systems and champion their benefits

Requirements

Ability to build a strategy around access that balances usability, security and compliance requirements, flexible to changes in user patterns; Prior experience managing and growing high performing teams; Proven ability to threat model complex systems, identify security risks, develop mitigation strategies with engineering teams, and see them through to delivery; Proven experience working with external stakeholder teams such as IT and Procurement to deliver secure SaaS solutions; Good understanding of internal IT environments and the security market, including zero trust, IDPs, SSPM, MDMs, and password managers; Ability to run large, complex projects across multiple groups, set the definition of done, track metrics, and deliver comms at company scale

Nice to have

Proficiency in one or more programming/scripting languages (Python, Golang, Java), with ability to mentor others on best practices; Familiarity with infrastructure as code (e.g. Terraform); Experience with identity management technologies (MFA, SAML, WebAuthn, Okta); Understanding of common compliance frameworks such as SOC2, ISO27001, GDPR

Benefits

Equity packages; Inclusive parental leave policy that supports all parents and carers; Annual Vibe & Thrive allowance to support wellbeing, social connection, office setup and more; Flexible leave options