Director of Security & Compliance

Director of Security & Compliance

Location: Remote (United States)
Reports to: VP of Data & Technology Operations
Employment Type: Exempt/Full-Time

About StrongMind:

StrongMind is a remote-first education and technology company on a mission to transform learning for students, families, and educators across the country. For more than 25 years, we’ve partnered with schools and districts to deliver innovative, student-centered learning experiences powered by technology, compassion, and bold thinking.

We believe education should be flexible, human, and built for real life. That belief shapes how we design our products, support our partners, and work together as a team. At StrongMind, you’ll find smart people doing meaningful work, a culture rooted in trust and accountability, and leaders who genuinely care about both outcomes and people.

The Team You Will Join:

You’ll be part of the Data & Technology Operations team, working closely with IT Operations, Engineering, Data Science, Legal, leadership, and external security and compliance partners. This team is responsible for protecting StrongMind’s systems and data while building the security, privacy, and compliance programs that support our schools, products, employees, and customers.

This role sits alongside our IT Operations and Engineering teams and is designed to provide dedicated ownership of StrongMind’s security and compliance program. You’ll coordinate controls across teams without directly managing those teams and will provide direction to contracted security resources supporting hands-on implementation.

The team culture is collaborative, accountable, proactive, and mission-driven. You’ll have significant opportunities to build programs from the ground up, influence security strategy, strengthen organizational practices, and help scale StrongMind’s security and compliance capabilities as the company grows.

The Difference You Will Make:

In this role, your work will directly impact students, families, schools, employees, and StrongMind’s technology environment by ensuring our security, privacy, and compliance programs are thoughtfully designed, consistently implemented, and continuously improved.

You’ll own StrongMind’s security and compliance program, including SOC 2, student data privacy, access governance, third-party risk, incident readiness, and AI governance. Your work will help protect sensitive student and family information, strengthen organizational trust, and ensure our security and compliance practices keep pace with the evolving education and technology landscape.

This is a high-ownership opportunity for someone who can build a program from the ground up, coordinate across teams, and turn policies and requirements into processes that actually operate.

A Typical Day Looks Like:

While no two days are exactly the same, you can expect to:

• Own the SOC 2 program end to end, including scope, control design, evidence collection, auditor relationships, Type I and Type II attestation, and ongoing annual reattestation.
• Coordinate security and compliance controls across IT Operations and Engineering, ensuring control owners understand expectations and provide appropriate evidence on schedule.
• Establish and maintain access governance policies covering provisioning, access reviews, and revocation across the organization.
• Manage operational compliance requirements related to COPPA, FERPA, state student privacy laws, and public records obligations in partnership with Legal.
• Build and maintain a risk-based vendor and third-party risk management program across cloud infrastructure, data platforms, and education-specific vendors.
• Monitor internal security posture, including cloud security findings, corporate SaaS security, and overall defensive readiness.
• Develop and maintain incident response plans, breach preparedness procedures, runbooks, and tabletop exercises.
• Partner with the AI committee and Data Science organization to establish responsible governance for AI systems that interact with student data and evaluate security and privacy considerations for AI-enabled products and vendors.
• Direct contracted security resources, including vCISO or specialist support, ensuring implementation work aligns with program priorities and organizational needs.
• Establish recurring processes for vendor risk reviews, access reviews, evidence collection, control monitoring, and leadership reporting.
• Provide leadership with clear, actionable risk reporting to support informed organizational decision-making.

This role balances strategic program ownership, cross-functional collaboration, risk management, and execution and is well-suited for someone who enjoys building programs, solving complex problems, creating structure, and influencing outcomes across teams.

Your Expertise Includes:

• Demonstrated experience owning and operating a security and compliance program, ideally through at least one SOC 2 attestation from program buildout through final report.
• Strong understanding of security controls, compliance frameworks, risk management, and audit processes.
• Proven ability to coordinate controls and drive accountability across teams you do not directly manage.
• Experience directing contractors, consultants, vCISOs, or other external security resources.
• Experience working in K–12, education technology, or another highly regulated data environment.
• Strong understanding of student privacy requirements, including COPPA and FERPA, or comparable privacy and regulatory frameworks.
• Experience building security and compliance programs from the ground up and translating policies into repeatable, operational processes.
• Strong communication, organization, and project management skills with the ability to work effectively with technical and non-technical stakeholders.
• Ability to identify risk, communicate its potential impact, and establish practical strategies for mitigation.
• Ability and willingness to grow a security and compliance function as StrongMind’s needs and technology portfolio expand.

Bonus points if you also have:

• Direct EdTech experience or experience working with state student privacy laws and statewide data privacy agreements.
• Experience with compliance automation platforms such as Vanta, Drata, Delve, or similar tools.
• Experience with cloud security posture management tools such as Wiz or similar platforms.
• Experience supporting GDPR compliance or international privacy programs.
• CISSP, CISM, CISA, or comparable security or compliance certification.
• Experience governing AI systems or evaluating AI vendors in a regulated data environment.

Our Commitment to Inclusion & Belonging:

We believe the best ideas come from bringing together people with different perspectives, experiences, and ways of thinking. We are committed to welcoming a broad range of talent and encouraging all qualified individuals to apply. We strive to create an environment where everyone feels a sense of belonging and is empowered to contribute, grow, and do meaningful work.

How We'll Take Care of You:

We believe that when people feel supported, they do their best work.

Our commitment to you includes:

• A competitive total compensation package, including medical, dental, vision, and voluntary benefits

• Well-being that works for real life—from an on-site gym, virtual wellness programs, and wellness coaching to flexible work options for select roles, because your well-being fuels your brilliance
• Unlimited PTO for salaried roles and “life happens” days when you need flexibility
• A fully paid holiday week off at Christmas, so you can truly rest, reset, and reconnect
• Recognition and rewards that celebrate birthdays, meaningful anniversary milestones, and community service hours that let you give back
• Quarterly Town Halls that keep communication transparent, honest, and human
• Annual social events and traditions we genuinely look forward to—like Halloween celebrations, Wellness Fairs, and other moments that bring our community together

We’re intentional about building a workplace where people feel valued, connected, and empowered to thrive—at work and beyond.

Additional Info:

We welcome all qualified candidates eligible to work in the United States.  At this time, we are unable to sponsor visas.

We are proud to be an Equal Opportunity Employer and provide consideration to all applicants regardless of race, religion, color, sex, gender, national origin, age, veteran status, marital status, or disability protected by law.