Director of Security

Finalsite•Glastonbury, CT

20h•Remote

About The Position

Finalsite is hiring a Director of Security to lead its security team and formalize the company’s security program. The role sets the team’s direction, leads the effort toward SOC 2 Type 2 attestation, leads security incident response, and develops practices that enable engineering teams to deliver securely. The program spans compliance, customer trust, vendor risk, application security, cloud and infrastructure security, and identity and access across a broad software estate with multiple products, technology generations, cloud providers, and distributed teams. The Director will build controls into existing engineering workflows so they operate consistently in practice and produce evidence as a natural byproduct. The role owns the security roadmap, team, customer-facing security documentation and assessments, and decisions presented to the CISO. The Director reports to the Senior Director of SRE and Security and works closely with SRE. A part-time CISO approves security policy, makes formal risk acceptance decisions, and is accountable for the program to auditors and customers; the Director runs the program overseen by the CISO. This is a 100% remote role limited to people who are permanent residents of the United States and who maintain U.S. residency. K–12 experience and familiarity with Finalsite’s technology stack are not required.

Requirements

Eight or more years of experience in information security, including three or more years leading a security team.
Hands-on technical credibility across application security and cloud infrastructure, sufficient to evaluate designs and architectures.
Direct experience taking an organization through a SOC 2 Type 2 audit or comparable attestation such as ISO 27001.
Experience leading customer security reviews and third-party vendor risk assessments at a software company.
Experience leading responses to real security incidents, coordinating engineers, executives, and customers.
Experience partnering with a CISO or another executive who owns security risk decisions, including preparing those decisions.
Experience partnering with engineering teams to get security requirements adopted.
Clear, honest communication about risk with technical and non-technical audiences.
Experience hiring and developing security professionals.
Comfort working with colleagues across multiple countries and time zones.
Permanent U.S. residency, with continued residency in the United States required for employment.

Nice To Haves

Experience running a compliance automation platform such as Vanta, Drata, or Secureframe, including a customer-facing trust center.
Experience leading a company through its first SOC 2 Type 2 attestation.
Security leadership at a SaaS company with multiple products or a history of acquisitions.
Experience with established systems spanning multiple technology generations, where security improvements must be delivered alongside ongoing work.
PCI DSS experience for software that handles payments.
Experience with student or children’s data privacy, including FERPA, COPPA, and state student privacy laws, or other heavily regulated data.
Experience securing software across more than one cloud provider.
Identity and access security experience, including large single sign-on and multi-factor authentication rollouts.
Experience building a security program with a small team and growing it deliberately.
Experience assessing security and privacy risks of AI-enabled products and using AI-assisted tools in security work.
Experience with K–12 or other public-sector customers and their procurement and security review processes.

Responsibilities

Lead the security team, including setting priorities, hiring, developing, and managing engineers and analysts, and making performance review, promotion, and compensation recommendations.
Build and run the security roadmap with the CISO, prioritize work by risk to schools and the business, and make tradeoffs visible alongside product and engineering plans.
Lead SOC 2 Type 2 attestation execution, including scope definition, control assessment, remediation planning, the observation period, continuous evidence collection, and auditor and CISO support.
Own and manage Vanta and keep the Customer Trust Portal and external-facing security documentation current and accurate.
Lead customer security questionnaires and external assessments in partnership with sales and customer success.
Establish security evaluations for new third-party vendors, especially vendors that process school and customer data, and raise associated risks to the CISO.
Build controls into engineering workflows and maintain an accurate view of current control coverage and plans to expand it.
Draft and maintain security policies and standards for CISO approval, making them workable for engineers.
Prepare security decisions for the CISO with clear options, consequences, and recommendations, and drive follow-through after decisions are made.
Lead security incident response by maintaining plans and playbooks, serving as incident lead, coordinating with SRE and support, legal, and customer-facing teams, and ensuring post-incident follow-up is completed.
Run vulnerability management across applications, infrastructure, and dependencies, with clear ownership and achievable remediation timelines.
Establish secure design practices, including threat modeling and security review of new services and major changes early enough to influence design.
Partner with SRE, identity, and platform teams on access control, authentication protections, secrets management, and security-event logging and monitoring.
Assess security and privacy implications of new capabilities, including AI-enabled features, before they reach schools.
Train engineers and the wider company on security practices and encourage early reporting of mistakes and near misses.
Report security risk and progress to leadership in clear terms, including when circumstances are unfavorable.
Manage the security budget and recommend whether to build, buy, or partner for tools and capabilities.