Director of Security & IT

• Direct reports: IT & Security team, which you'll grow as we scale
• Partners with: Director of R&D and R&D engineers, the executive team, HR, auditors, pen testers, our insurer, and banking and payment partners
• Location: Hybrid, with regular office days in Lexington, KY
• Target start: December 2026
• Salary range: $150,000–$180,000 base, plus stock options and benefits

About PayHOA

PayHOA is the all-in-one software that lets self-managed HOAs and condo associations run their communities 100% online — dues, payments, accounting, communication, and more. More than 6,000 communities trust us, customers rate us 4.7 stars on Capterra and G2, and our support team holds a 98.7% satisfaction score.

Founded in Lexington in 2018, PayHOA bootstrapped its way to profitability before raising a $27.5M Series A in 2024. We're still a close-knit team where everyone's work is felt by customers and teammates alike, and we're looking for people who want to build something lasting together.

Mission: Powerfully simple community management, for all.

Values: Always Leveling Up
· Own the Outcome
· Engineer Powerful Simplicity
· Listen. Solve. Wow.
· Proud of the Work, Proud of the Place

About the Role

You’ll lead security and IT at PayHOA and own the whole program — set the roadmap, lead compliance and incident response, and run corporate IT. This is a build-and-run role. Some parts of the program are established and others you’ll shape, and we’ll walk you through exactly where things stand during the interview process.

The role sits outside R&D so security calls stay independent of delivery pressure, but most of the day‑to‑day work happens alongside R&D. This is a hands‑on director role. You’ll set the policy and read the logs, and you’ll grow the team as the company grows.

What success looks like in year one

• A risk‑based security roadmap, agreed with leadership, with visible progress against it
• Compliance and audit milestones met on the timeline you set
• Incident response that’s documented, rehearsed, and owned
• Security metrics that leadership and the board review regularly

Why this role

• Executive backing and budget already set aside
• A direct line to Finance leadership — security isn’t buried under ship dates
• An AI‑forward team
• Room to grow the function as we scale

What You’ll Do

Program and governance

• Own the security roadmap, sequenced by risk and company stage, and review it with the Director of Finance and Director of R&D
• Own the risk register and risk‑acceptance process, with clear control owners in each department
• Own and maintain the security policy set (access, acceptable use, vendor risk, data handling, incident response, and BC/DR)
• Define metrics that show controls are working, and report risk plainly to leadership and the board

Compliance and audit

• Own our compliance program, including SOC 2 and the audits and attestations customers and partners expect
• Run the compliance platform and continuous evidence collection across HR, device, and cloud systems
• Own security inputs to the annual financial audit, cyber insurance, banking‑partner due diligence, and customer security questionnaires
• Partner with Finance and R&D on business continuity and disaster recovery, and run the annual recovery test

Identity, access, and corporate IT

• Own identity and access across our identity provider and SaaS tools, including SSO, phishing‑resistant MFA, and passkeys
• Own least‑privilege access and periodic access reviews across cloud, CI/CD, and the platforms that hold sensitive data and payments
• Own joiner, mover, and leaver processes across every system
• Own device management, endpoint security, software inventory, and the office network
• Run security awareness training and phishing simulations

Cloud and application security (with R&D)

• Set the security standard…