Director of Security

Who We Are Finalsite is the most valued partner for K–12 schools to build trust, strengthen community, and grow enrollment. Ranked among the best EdTech Companies in America, Finalsite supports more than 7,000 schools and districts worldwide with an integrated platform for websites, communications, mobile apps, enrollment, and marketing services. Headquartered in Glastonbury, Connecticut, Finalsite is a global company with employees working remotely across nearly every U.S. state, as well as throughout Europe, South America, and Asia. We believe people do their best work when they feel supported, connected, and empowered to grow. That’s why we invest in our employees through competitive benefits, professional development opportunities, and a collaborative culture built on partnership and purpose. Whether you’re looking to expand your skills, take on new challenges, or make a meaningful impact in education, Finalsite offers the opportunity to grow your career while helping schools thrive. At Finalsite, every interaction matters — with our clients, with each other, and with the schools and families we serve. Join us and help shape stronger school communities around the world Summary You will lead the team responsible for it. This is a hands-on leadership role at a company that is formalizing its security program. You will set direction for the team, lead us toward SOC 2 Type 2 attestation, lead the response when something goes wrong, and build the practices that let engineering teams ship securely without waiting in a queue for permission. The environment is broad. Finalsite is an established software estate spanning several products and several generations of technology, hosted across more than one cloud provider, and built by distributed teams in multiple countries. The products are increasingly meant to work together as one platform, which means the security program has to span products as well. Your work will cover compliance, customer trust, vendor risk, application security, cloud and infrastructure, and identity and access. We want SOC 2 Type 2 attestation to describe how our engineering teams actually work. Type 2 looks at whether controls operated consistently over an observation period, so they have to hold up in everyday practice and not only exist on paper. That means controls built into the design review, deployment, access, and incident practices teams already follow, with evidence produced as a byproduct of that work instead of assembled before an audit. The attestation matters to our customers, and the program behind it matters more. You will report to the Senior Director of SRE and Security, in the same organization as the SRE team you will work with every day. Finalsite also has a part-time CISO, who approves security policy, makes formal risk acceptance decisions, and is accountable for the program to auditors and customers. You will run the program that the CISO oversees. That includes the team, the roadmap, the security documentation and assessments customers see, and the decisions you bring to the CISO. You do not need K-12 experience or familiarity with our stack. We are looking for a security leader who can earn engineers' trust, who is comfortable being accountable when an incident happens, who can explain risk plainly to executives and to customers, and who works well with a CISO who holds the final call on policy and risk. LOCATION 100% Remote - Anywhere within the US Responsibilities Lead the security team: set its priorities, hire, develop, and manage its engineers and analysts, including performance reviews, promotions, and compensation recommendationsBuild and run the security roadmap, agreeing priorities with the CISO, ranking work by risk to schools and to the business, and making those tradeoffs visible in planning next to product and engineering workLead execution of SOC 2 Type 2 attestation, including defining scope, assessing current controls, planning and driving remediation, running the observation period with continuous evidence collection, and giving the CISO and the auditors what they needOwn and manage Vanta, our security and compliance platform, so that the Customer Trust Portal and external-facing security documentation stay current and accurately reflect Finalsite's security posture for customers and auditorsLead the review and completion of customer security questionnaires and external assessments, partnering with sales and customer success to describe Finalsite's security practices clearly and accuratelyEstablish and run security evaluations of new third-party vendors, with particular attention to vendors that process school and customer data, and bring the risks they carry to the CISO's attentionBuild controls into the way engineering teams already work, and keep an accurate picture of where each control applies today and how that coverage will expandDraft and maintain security policies and standards for the CISO's approval, and make them workable for the engineers who have to follow themPrepare decisions for the CISO, with clear options, consequences, and a recommendation, and drive the follow-through once a decision is madeLead response to security incidents: maintain the response plan and playbooks, serve as incident lead for security events, coordinate with SRE, which runs the broader incident process, and with support, legal, and customer-facing teams, and make sure post-incident follow-up actually gets doneRun vulnerability management across applications, infrastructure, and dependencies, with clear ownership and remediation timelines that engineering teams can meetEstablish secure design practices, including threat modeling and security review for new services and major changes, early enough to change the designPartner with SRE, identity, and platform teams on access control, authentication protections, secrets management, and logging and monitoring that surface security eventsAssess the security and privacy implications of new capabilities, including AI-enabled features, before they reach schoolsTrain engineers and the wider company on security practices, and help build a culture where people report mistakes and near misses earlyReport on security risk and progress to leadership in plain terms, including when the news is badManage the security budget, and make tooling and build, buy, or partner recommendations Qualifications And Skills Eight or more years in information security, including three or more leading a security teamHands-on technical credibility across application security and cloud infrastructure, enough to evaluate a design or an architecture yourselfDirect experience taking an organization through a SOC 2 Type 2 audit, or a comparable attestation such as ISO 27001Experience leading customer security reviews and third-party vendor risk assessments at a software companyExperience leading response to real security incidents, including coordinating engineers, executives, and customers at the same timeExperience partnering with a CISO or another executive who owns security risk decisions, including preparing those decisions wellExperience working with engineering teams as a partner, so that security requirements get adoptedClear, honest communication about risk with technical and non-technical audiencesExperience hiring and developing security professionalsComfort working with colleagues across several countries and time zones Preferred Qualifications Running a compliance automation platform such as Vanta, Drata, or Secureframe, including a customer-facing trust centerLeading a company through its first SOC 2 Type 2 attestationSecurity leadership at a SaaS company with multiple products or a history of acquisitionsEstablished systems spanning multiple generations of technology, where security improvements have to land alongside ongoing deliveryPCI DSS experience for software that handles paymentsStudent or children's data privacy, including FERPA, COPPA, and state student privacy laws, or other heavily regulated dataSecuring software across more than one cloud providerIdentity and access security, including large single sign-on and multi-factor authentication rolloutsBuilding a security program with a small team and growing it deliberatelyAssessing the security and privacy risks of AI-enabled products, and using AI-assisted tools in security workExperience with K-12 or other public-sector customers and their procurement and security review processes RESIDENCY REQUIREMENT Finalsite offers 100% fully remote employment opportunities, however, these opportunities are limited to permanent residents of the United States. Current residency, as well as continued residency, within the United States is required to obtain (and retain) employment with Finalsite. DISCLOSURES Finalsite is proud to be an equal opportunity workplace and is an affirmative action employer. We are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or Veteran status. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. EEO is the Law. If you have a disability or special need that requires accommodation, please contact Finalsite's People Operations Team. Finalsite is committed to the full inclusion of all qualified individuals. As part of this commitment, Finalsite will ensure that persons with disabilities or special needs are provided a reasonable accommodation. Ensure your Finalsite job offer is legitimate and don't fall victim to fraud. Ask your recruiter for a phone call or other type of verbal communication and ensure all email correspondence is from a finalsite.com email address. For added security, where possible, apply through our company website at finalsite.com/jobs.