Director of Security & Compliance

Director of Security & Compliance

Location:

Greater Phoenix, Arizona – Onsite (Potential for Hybrid schedule)

Reports to:

VP of Data & Technology Operations

Employment Type:

Exempt/Full-Time

Strong Mind is a remote-first education and technology company on a mission to transform learning for students, families, and educators across the country. For more than 25 years, we've partnered with schools and districts to deliver innovative, student-centered learning experiences powered by technology, compassion, and bold thinking.

We believe education should be flexible, human, and built for real life. That belief shapes how we design our products, support our partners, and work together as a team. At Strong Mind, you'll find smart people doing meaningful work, a culture rooted in trust and accountability, and leaders who genuinely care about both outcomes and people.

You'll be part of the Data & Technology Operations team, working closely with IT Operations, Engineering, Data Science, Legal, leadership, and external security and compliance partners. This team is responsible for protecting Strong Mind's systems and data while building the security, privacy, and compliance programs that support our schools, products, employees, and customers.

This role sits alongside our IT Operations and Engineering teams and is designed to provide dedicated ownership of Strong Mind's security and compliance program. You'll coordinate controls across teams without directly managing those teams and will provide direction to contracted security resources supporting hands-on implementation.

The team culture is collaborative, accountable, proactive, and mission-driven. You'll have significant opportunities to build programs from the ground up, influence security strategy, strengthen organizational practices, and help scale Strong Mind's security and compliance capabilities as the company grows.

In this role, your work will directly impact students, families, schools, employees, and Strong Mind's technology environment by ensuring our security, privacy, and compliance programs are thoughtfully designed, consistently implemented, and continuously improved.

You'll own Strong Mind's security and compliance program, including SOC 2, student data privacy, access governance, third-party risk, incident readiness, and AI governance. Your work will help protect sensitive student and family information, strengthen organizational trust, and ensure our security and compliance practices keep pace with the evolving education and technology landscape.

This is a high-ownership opportunity for someone who can build a program from the ground up, coordinate across teams, and turn policies and requirements into processes that actually operate.

While no two days are exactly the same, you can expect to:

• Own the SOC 2 program end to end, including scope, control design, evidence collection, auditor relationships, Type I and Type II attestation, and ongoing annual reattestation.
• Coordinate security and compliance controls across IT Operations and Engineering, ensuring control owners understand expectations and provide appropriate evidence on schedule.
• Establish and maintain access governance policies covering provisioning, access reviews, and revocation across the organization.
• Manage operational compliance requirements related to COPPA, FERPA, state student privacy laws, and public records obligations in partnership with Legal.
• Build and maintain a risk-based vendor and third-party risk management program across cloud infrastructure, data platforms, and education-specific vendors.
• Monitor internal security posture, including cloud security findings, corporate SaaS security, and overall defensive readiness.
• Develop and maintain incident response plans, breach preparedness procedures, runbooks, and tabletop exercises.
• Partner with the AI committee and Data Science organization to establish responsible governance for AI systems that interact with student data and evaluate security and privacy considerations for AI-enabled products and vendors.
• Direct contracted security…