Enterprise Security Manager

About the role

The Internal Systems Security team protects Canva's internal endpoints, networks, systems and data, and partners with IT, Sales and Customer Support to embed security early in their roadmaps. The Enterprise Security Manager leads a team of security engineers within this group, which also covers application security, risk management and threat detection and response. The role must balance security with user experience, and candidates are assessed on AI coding, security review and system design skills.

Key responsibilities

• Manage a team of security engineers doing threat modelling, security tool rollouts, building internal security services and partnering with other teams on security strategy.
• Own the strategy for internal security, balancing security, compliance and developer experience so users can move quickly with secure guardrails.
• Coach and develop engineers through regular, practical feedback, and own ways of working such as sprint planning, stand-ups and retrospectives.
• Work with partner groups to scale security improvements and drive adoption of the systems built.

Required profile

• Ability to build an access strategy that balances usability, security and compliance, adapting to changing user patterns.
• Prior experience managing and growing high-performing teams.
• Proven ability to threat model complex systems, identify risks, develop mitigations with engineering teams and see them through to delivery.
• Experience working with external stakeholder teams such as IT and Procurement to deliver secure SaaS solutions.
• Good understanding of internal IT environments and the surrounding security market.
• Ability to run large, complex projects across multiple groups, define done, track metrics and communicate at company scale.

Required skills

• Threat modelling and security risk identification.
• Knowledge of zero trust, IDPs, SSPM, MDMs and password managers.
• Beneficial: scripting languages (Python, Golang, Java), infrastructure as code (Terraform), identity management (MFA, SAML, WebAuthn, Okta) and compliance frameworks (SOC2, ISO27001, GDPR).

What we offer

• Equity packages.
• Inclusive parental leave policy.
• An annual Vibe & Thrive allowance for wellbeing, social connection and office setup.
• Flexible leave options.