Head of IT & Security

About OpenEd: We’re opening the world to every learner. With over 100,000 students served and growing rapidly, families trust us as a partner to the most precious thing in their lives—their children. Our vision is a future where education is no longer constrained by geography, rigid models, or outdated systems. Our mission is to give every student customized, world-class education and resources, empowering families and opening millions of doors for learners across the country.

Our Culture

Culture at OpenEd is intentional. It’s defined by what we promote—and what we tolerate. Our latest eNPS (employee net promoter score) of 76 places OpenEd in the top 0.1% of technology companies. Our values aren't just words; they are non-negotiable principles that guide every decision:

• Customer First – Obsessed with delivering value; we fight tirelessly for our learners and families.
• Hard Choices, Easy Life – Face challenges directly, swiftly, and transparently.
• I Did > We Should – Action over theory; bring experiments, not just opinions.
• Learn Out Loud – Share your growth openly; feedback is a gift, ego is the enemy.
• Prioritize Ruthlessly – Excellence in the few critical areas over mediocrity everywhere.
• Fast AND World Class – Speed doesn’t compromise quality.
• Strong Opinions, Weakly Held – Advocate passionately, adjust readily.
• Make Others Famous – Elevate your colleagues, partners, and community.

We're currently accepting applications from those living in: AR, AZ, CO, FL, GA, ID, IN, IL, IO, KS, MA, MD, MN, MO, MT, NC, NM, NV, NY, OH, OK, OR, RI, SC, TN, TX, UT, VA, WA, WI, WV.

About the Role

As the founding Security Engineer at OpenEd, you'll join a small, high-impact team changing the nature of education. This is a truly unique opportunity to be the founding member of our security team and to ensure we earn the trust of families that their student's education—and data—is safe with us. You'll own the IT, identity, and compliance programs directly, with a broad range of responsibilities and the autonomy to tackle them as you see fit. We serve over 100,000 students, which means the security bar isn't theoretical: it's the reason families keep trusting us with their kids.

Responsibilities

Your Immediate Impact:

• Identity & access: SSO/SAML, MFA, provisioning, a least-privilege access model, and reliable onboarding/offboarding.
• Corporate/IT security: Endpoint/MDM, SaaS and vendor risk, the phishing and awareness program, and incident response playbooks.
• Compliance: Drive SOC 2 (Type II), map FERPA/COPPA/state privacy controls, and own audits and their outcomes.
• Application security: Contribute to key AppSec initiatives (SAST/DAST/SCA in CI), triage and drive remediation with engineers, and run external pen test audits.

Success Metrics

In your first 12 months:

• Compliance: SOC 2 Type II readiness completed, gaps remediated, and the audit window passed with no material exceptions.
• Identity: Every employee and contractor on SSO with MFA enforced, access granted by least-privilege role, and onboarding/offboarding running on automated provisioning with same-day deprovisioning.
• Endpoint coverage: Full MDM enrollment across the fleet with enforced, documented baselines.
• Vulnerability management: SAST/DAST/SCA running in CI, severity-based remediation SLAs consistently met, and an annual external pen test with findings tracked to closure.
• Readiness: Incident response playbooks documented and exercised, and a phishing/awareness program running with measurably improving results.
• Privacy: FERPA, COPPA, and state privacy requirements mapped to controls with evidence collection that doesn't depend on a fire drill.

Requirements

• 6+ years in security, ideally in a regulated vertical (finance, education, healthcare).
• Hands-on across IT/identity and security operations—not just advisory.
• You've taken an org through SOC 2 (or ISO 27001).
• Experienced at establishing and driving human-centered processes for ensuring security across an organization.
• Strong judgment on risk: you know what actually matters and what's theater.
• Deeply technical with excellent communication skills—able to work with software engineers and elementary school teachers equally well.
• Hands-on experience designing or running a zero-trust environment (e.g., identity-based access, continuous verification, no implicit network trust).

Qualifications

• Bonus: Edtech/FERPA/privacy background, CISSP, or OSCP.

What Excites You About This Role

• You'd rather automate a security control than police it manually.
• You design systems that are robust to inevitable human failure rather than aiming for perfect human compliance.
• You want the full surface area—identity, IT, compliance, and AppSec—instead of a narrow slice of someone else's program.
• A blank slate energizes you more than an inherited playbook does.
• You want the thing you're protecting to matter: the education and personal data of 100,000+ students.

Team & Autonomy

You are the security team. You'll set the strategy, choose the tooling, and decide the sequencing, partnering closely with engineering, IT, and legal as you go. Expect wide latitude and very little process standing between you and shipping a control—along with the accountability that comes with being the person who owns the outcome.

This role reports directly to the CTO.