Head of IT & Security

OpenEd

23h • $195,000 - $220,000

About The Position

OpenEd is hiring its founding security team member to own IT, identity, and compliance programs and help protect the education and personal data of more than 100,000 students. The role has broad responsibility and autonomy, including setting security strategy, selecting tools, and sequencing work while partnering with engineering, IT, and legal.

The role owns four programs end to end: identity and access; corporate and IT security; compliance; and application security. Key objectives include achieving SOC 2 Type II readiness and completing the audit window without material exceptions, enforcing SSO and MFA with least-privilege access and automated onboarding and offboarding, achieving full MDM enrollment with documented baselines, operating vulnerability management in CI, exercising incident response playbooks, and mapping privacy requirements to controls and evidence.

Requirements

• At least 6 years of experience in security; experience in a regulated industry such as finance, education, or healthcare is preferred.
• Hands-on experience across IT/identity and security operations, rather than advisory work alone.
• Experience taking an organization through SOC 2 or ISO 27001.
• Experience establishing and driving human-centered processes for organization-wide security.
• Strong judgment in assessing meaningful security risks.
• Deep technical skills and excellent communication skills, including the ability to work with software engineers and elementary school teachers.
• Hands-on experience designing or running a zero-trust environment, such as identity-based access, continuous verification, and no implicit network trust.

Nice To Haves

• Edtech, FERPA, or privacy background.
• CISSP certification.
• OSCP certification.

Responsibilities

• Own identity and access programs, including SSO/SAML, MFA, provisioning, least-privilege access, and reliable onboarding and offboarding.
• Own corporate and IT security, including endpoint and MDM security, SaaS and vendor risk, phishing and security awareness, and incident response playbooks.
• Drive SOC 2 Type II readiness, map FERPA, COPPA, and state privacy controls, and own audits and their outcomes.
• Contribute to application security initiatives, including SAST, DAST, and SCA in CI; triage vulnerabilities and drive remediation with engineers; and run external penetration test audits.
• Set security strategy, choose tooling, and determine implementation sequencing.
• Partner with engineering, IT, and legal to deliver security controls.
• Document and exercise incident response playbooks and run a phishing and awareness program.
• Establish evidence collection for privacy controls and track vulnerability findings through remediation.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed