Senior Director, Compliance

College Board•Remote - Virginia, VA

4d•$120,000 - $175,000•Remote

About The Position

The Senior Director, Compliance will lead College Board’s external compliance program, contributing to the successful execution of SOC 2, ISO 27001, and PCI DSS audits in partnership with GRC leadership and internal stakeholders. This role will coordinate with external auditors, and ensure controls are designed, implemented, documented, and operated effectively within College Board’s cloud-based systems. The role leads the ongoing development of the compliance program by helping define and mature the compliance strategy, standardize processes and evidence practices, and collaborate cross-functionally with technical and non-technical stakeholders to drive accountability, continuous audit readiness, and scalable compliance delivery.

Requirements

8-10+ years of progressive experience in networking, information security, and security auditing, with increasing responsibility across technical implementation, control design, risk assessment, and audit leadership.
Background in IT, IT security, security auditing, or IT audit, with the ability to connect technical control design to external audit requirements.
Proven ability to lead end to end SOC 2, ISO 27001, PCI DSS, or similar audits, with deep practical expertise in control interpretation, cross framework mapping, evidence strategy, audit walkthroughs, and direct engagement with external auditors in cloud-based environments.
Deep, practical knowledge of ISO 27001, SOC 2 (Trust Services Criteria), and PCI DSS, with the ability to translate controls into clear, actionable technical requirements that engineering and operations teams can implement effectively and sustainably.
Strong ability to evaluate and assess cloud native architectures against security best practices, primarily in AWS.
Solid background in security engineering and networking, with hands on understanding of identity and access management, network segmentation, encryption, logging, monitoring, and secure system design in modern cloud environments.
Strong preference for experience leading individuals, project teams, or cross-functional workstreams to measurable outcomes.
Ability to work effectively across technical and non-technical teams (business areas, engineering, legal, procurement, operations), building trust and alignment while driving agreement on control ownership, remediation approaches, and audit outcomes.
Exceptional written and verbal communication skills, with the ability to explain complex security risks, audit findings, and control gaps to both technical audiences and senior leadership in a clear, concise manner.
Strong planning, prioritization, and execution skills, capable of managing multiple concurrent audit timelines, remediation efforts, and control dependencies in fast-paced, evolving environments.
Ability to communicate the value of compliance work in clear business terms, helping stakeholders understand how audit readiness, effective controls, and timely remediation reduce risk, protect trust, and lead College Board’s mission.
Bachelor’s degree required.
A passion for expanding educational and career opportunities and mission-driven work grounded in our Operating Principles and Manager Expectations.
Curiosity and enthusiasm for emerging technologies, with a willingness to experiment with and adopt new AI-driven solutions and comfort with learning and applying new digital tools independently and proactively.
Clear and concise communication skills, written and verbal.
A learner's mindset and a commitment to growth: welcoming diverse perspectives, giving and receiving timely, respectful feedback, and continuously improving through iterative learning and user input.
A drive for impact and excellence: solving complex problems, making data-informed decisions, prioritizing what matters most, and continuously improving through learning, user input, and external benchmarking.
A collaborative and empathetic approach: working across differences, fostering trust, and contributing to a culture of shared success.
The ability to travel 3-4 times a year to College Board offices or on behalf of College Board business.
Authorization to work in the United States.

Nice To Haves

A working knowledge of comparable services and controls in Azure and/or Google Cloud Platform preferred.
Prior experience implementing, operating, or leading continuous compliance monitoring capabilities (e.g., automated control monitoring, evidence collection, or compliance tooling) is preferred.
Exceptional candidates can effectively speak to: Security certifications (e.g., CISSP, CRISC, CISM, CISA) preferred.

Responsibilities

Lead the execution of external compliance audits (SOC 2, ISO 27001, PCI DSS), by assisting with audit planning, scope definition, evidence strategy, walkthrough coordination, issue resolution, and successful delivery of audit results in partnership with GRC leadership.
Act as a key liaison to external auditors, leading audit communications, responding to information requests, participating in audit discussions, and providing technical context and judgement on findings, clarifications, and interpretation of requirements.
Partner closely with internal stakeholders and control owners across business areas, engineering, legal, and operations to align on audit scope, control responsibilities, evidence requirements, and remediation plans throughout the audit lifecycle.
Lead control readiness and continuous audit preparedness by working with control owners to help ensure controls are designed, implemented, documented, and operating effectively throughout the audit period.
Lead the development and execution of College Board’s compliance strategy and roadmap, focused on SOC 2, ISO 27001, PCI DSS, and related frameworks, ensuring alignment with business objectives and cloud‑native operating models in collaboration with GRC leadership.
Contribute to the maturation and scalability of the compliance program by helping standardize control design, documentation, evidence collection, and operating procedures to improve audit efficiency, consistency, and repeatability year over year.
Lead the establishment and ongoing operation of the compliance governance processes, including control ownership, compliance monitoring, issue tracking, and exception management, to help maintain sustained audit readiness and control effectiveness.
Promote a culture of continuous compliance readiness, working with stakeholders to embed compliance requirements into day‑to‑day operations and technical workflows rather than treating audits as point‑in‑time events.
Identify opportunities to mature the compliance program through automation, continuous monitoring, improved evidence practices, and more scalable audit readiness processes.
Provide technical lead on compliance‑driven control design and implementation, ensuring SOC 2, ISO 27001, and PCI DSS requirements are translated into effective, auditable controls within cloud‑native environments.
Provide guidance and expertise during compliance assessments and audits, leading control walkthroughs, validating control operation, and confidently explaining system architectures and security mechanisms to auditors.
Participate in the review of technical implementations from a compliance perspective, identifying gaps, weaknesses, or audit risks early and recommending pragmatic, scalable remediation approaches.
Build strong working relationships and trust with stakeholders at all levels, leading productive collaboration, timely decision‑making, and effective resolution of compliance‑related issues.
Partner with cross‑functional teams including business areas, engineering, legal, and operations to help ensure compliance requirements are understood, owned, and executed consistently across the organization.
Lead the coordination of cross‑functional delivery of compliance initiatives, helping align timelines, dependencies, and responsibilities to lead audit readiness, remediation efforts, and ongoing control effectiveness.
Communicate compliance expectations, progress, and risks clearly, ensuring stakeholders remain informed, accountable, and aligned throughout audit cycles and compliance activities.
Build trust with internal stakeholders by positioning compliance as a partnership that represents and leads control owners, rather than a policing or “auditor” function.