Director of Security

You will lead the team responsible for it. This is a hands-on leadership role at a company that is formalizing its security program. You will set direction for the team, lead us toward SOC 2 Type 2 attestation, lead the response when something goes wrong, and build the practices that let engineering teams ship securely without waiting in a queue for permission.

The environment is broad. Finalsite is an established software estate spanning several products and several generations of technology, hosted across more than one cloud provider, and built by distributed teams in multiple countries. The products are increasingly meant to work together as one platform, which means the security program has to span products as well. Your work will cover compliance, customer trust, vendor risk, application security, cloud and infrastructure, and identity and access.

We want SOC 2 Type 2 attestation to describe how our engineering teams actually work. Type 2 looks at whether controls operated consistently over an observation period, so they have to hold up in everyday practice and not only exist on paper. That means controls built into the design review, deployment, access, and incident practices teams already follow, with evidence produced as a byproduct of that work instead of assembled before an audit. The attestation matters to our customers, and the program behind it matters more.

You will report to the Senior Director of SRE and Security, in the same organization as the SRE team you will work with every day. Finalsite also has a part-time CISO, who approves security policy, makes formal risk acceptance decisions, and is accountable for the program to auditors and customers. You will run the program that the CISO oversees. That includes the team, the roadmap, the security documentation and assessments customers see, and the decisions you bring to the CISO.

You do not need K-12 experience or familiarity with our stack. We are looking for a security leader who can earn engineers' trust, who is comfortable being accountable when an incident happens, who can explain risk plainly to executives and to customers, and who works well with a CISO who holds the final call on policy and risk.

LOCATION

100% Remote - Anywhere within the US

RESPONSIBILITIES

• Lead the security team: set its priorities, hire, develop, and manage its engineers and analysts, including performance reviews, promotions, and compensation recommendations

• Build and run the security roadmap, agreeing priorities with the CISO, ranking work by risk to schools and to the business, and making those tradeoffs visible in planning next to product and engineering work

• Lead execution of SOC 2 Type 2 attestation, including defining scope, assessing current controls, planning and driving remediation, running the observation period with continuous evidence collection, and giving the CISO and the auditors what they need

• Own and manage Vanta, our security and compliance platform, so that the Customer Trust Portal and external-facing security documentation stay current and accurately reflect Finalsite's security posture for customers and auditors

• Lead the review and completion of customer security questionnaires and external assessments, partnering with sales and customer success to describe Finalsite's security practices clearly and accurately

• Establish and run security evaluations of new third-party vendors, with particular attention to vendors that process school and customer data, and bring the risks they carry to the CISO's attention

• Build controls into the way engineering teams already work, and keep an accurate picture of where each control applies today and how that coverage will expand

• Draft and maintain security policies and standards for the CISO's approval, and make them workable for the engineers who have to follow them

• Prepare decisions for the CISO, with clear options, consequences, and a recommendation, and drive the follow-through once a decision is made

• Lead response to security incidents: maintain the response plan and playbooks, serve as incident lead for security events, coordinate with SRE, which runs the broader incident process, and with support, legal, and customer-facing teams, and make sure post-incident follow-up actually gets done

• Run vulnerability management across applications, infrastructure, and dependencies, with clear ownership and remediation timelines that engineering teams can meet

• Establish secure design practices, including threat modeling and security review for new services and major changes, early enough to change the design

• Partner with SRE, identity, and platform teams on access control, authentication protections, secrets management, and logging and monitoring that surface security events

• Assess the security and privacy implications of new capabilities, including AI-enabled features, before they reach schools

• Train engineers and the wider company on security practices, and help build a culture where people report mistakes and near misses early

• Report on security risk and progress to leadership in plain terms, including when the news is bad

• Manage the security budget, and make tooling and build, buy, or partner recommendations

QUALIFICATIONS AND SKILLS

• Eight or more years in information security, including three or more leading a security team

• Hands-on technical credibility across application security and cloud infrastructure, enough to evaluate a design or an architecture yourself

• Direct experience taking an organization through a SOC 2 Type 2 audit, or a comparable attestation such as ISO 27001

• Experience leading customer security reviews and third-party vendor risk assessments at a software company

• Experience leading response to real security incidents, including coordinating engineers, executives, and customers at the same time

• Experience partnering with a CISO or another executive who owns security risk decisions, including preparing those decisions well

• Experience working with engineering teams as a partner, so that security requirements get adopted

• Clear, honest communication about risk with technical and non-technical audiences

• Experience hiring and developing security professionals

• Comfort working with colleagues across several countries and time zones

PREFERRED QUALIFICATIONS

• R unning a compliance automation platform such as Vanta, Drata, or Secureframe, including a customer-facing trust center

• Leading a company through its first SOC 2 Type 2 attestation

• Security leadership at a SaaS company with multiple products or a history of acquisitions

• Established systems spanning multiple generations of technology, where security improvements have to land alongside ongoing delivery

• PCI DSS experience for software that handles payments

• Student or children's data privacy, including FERPA, COPPA, and state student privacy laws, or other heavily regulated data

• Securing software across more than one cloud provider

• Identity and access security, including large single sign-on and multi-factor authentication rollouts

• Building a security program with a small team and growing it deliberately

• Assessing the security and privacy risks of AI-enabled products, and using AI-assisted tools in security work

• Experience with K-12 or other public-sector customers and their procurement and security review processes

RESIDENCY REQUIREMENT

Finalsite offers 100% fully remote employment opportunities, however, these opportunities are limited to permanent residents of the United States. Current residency, as well as continued residency, within the United States is required to obtain (and retain) employment with Finalsite.

DISCLOSURES

Finalsite is proud to be an equal opportunity workplace and is an affirmative action employer. We are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or Veteran status. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. EEO is the Law. If you have a disability or special need that requires accommodation, please contact Finalsite's People Operations Team. Finalsite is committed to the full inclusion of all qualified individuals. As part of this commitment, Finalsite will ensure that persons with disabilities or special needs are provided a reasonable accommodation. Ensure your Finalsite job offer is legitimate and don't fall victim to fraud. Ask your recruiter for a phone call or other type of verbal communication and ensure all email correspondence is from a finalsite.com email address. For added security, where possible, apply through our company website at finalsite.com/jobs.