Director, Information Security

Overview

About PowerSchoolAt PowerSchool, we power education for students around the world. As the global leader in cloud-based K-12 software, we support the full education ecosystem - from the central office to the classroom to the home. Joining PowerSchool means being part of a mission-driven team that is transforming K-12 education by helping schools operate more effectively and deliver better outcomes for educators, students, and families.

About the position

The Director of Cybersecurity Strategy and Governance reports directly to the CISO and serves as a senior advisor on cybersecurity strategy, governance, risk, and program execution. In partnership with the CISO and cybersecurity leaders, this role helps formulate enterprise cybersecurity strategy and drives coordinated execution by maintaining the consolidated cybersecurity roadmap, establishing the leadership planning and reporting cadence, managing cross-functional dependencies, and partnering closely with the business PMO. The Director leads the Governance, Risk, and Compliance organization, including cybersecurity risk management, compliance, policy and standards, third-party risk management, security awareness, ISO 27001 and SOC 2 audit coordination, customer security assurance, and security control governance. Working collaboratively with the leaders of security architecture, security engineering, security operations, Product, Legal, Privacy, and other business functions, the Director strengthens execution, enables risk-informed decisions, and prepares consolidated cybersecurity updates for the CISO and executive leadership while preserving each leader’s accountability and decision authority within their domain.

Responsibilities

Description

Your day-to-day job will consist of:

• Work with the CISO and other cybersecurity leaders to develop the company’s cybersecurity strategy and turn it into a clear roadmap. The roadmap will include major projects, operational improvements, audit fixes, risk reduction plans, and security investments.
• Maintain the cybersecurity roadmap. Set the rules for which work belongs on it, coordinate priorities and dependencies across security teams, and recommend solutions to the CISO when priorities conflict.
• Plan and lead regular cybersecurity leadership meetings for strategy, planning, progress reviews, and reporting. Track decisions and commitments, follow up on action items, and raise major delays or gaps to the CISO.
• Serve as the main cybersecurity contact for the shared business PMO. Help turn security priorities into clear plans, milestones, dependencies, resource needs, and status updates.
• Set and enforce common standards for cybersecurity planning and reporting. Combine metrics and updates from security leaders, identify trends and risks across teams, and prepare updates for the CISO and executive leadership.
• Lead the Governance, Risk, and Compliance organization. This includes security risk, compliance, policies and standards, third-party risk, security awareness, ISO 27001 and SOC 2 audits, customer security assurance, and security control governance.
• Work with security and business leaders to develop a common method for rating cybersecurity risk. Maintain the security risk register and support consistent risk reviews, priorities, treatment plans, and reporting.
• Set and maintain rules for accepting security risks and approving policy exceptions. Review requests, recommend decisions based on approved authority levels, and track accepted risks, exceptions, and required fixes.
• Lead security control governance. Maintain the control framework, define control goals and evidence needs, monitor control coverage and fixes, and coordinate testing with Internal Audit, external auditors, and control owners.
• Manage cybersecurity relationships with Internal Audit and external ISO 27001 and SOC 2 auditors. Coordinate audit schedules, evidence, interviews, findings, corrective actions, and certification milestones.
• Maintain security policies, compliance programs, third-party risk processes, security awareness programs, and customer security assurance services. Make sure these programs support business goals, legal duties, customer commitments, and ongoing improvement.
• Work closely with Security Architecture, Security Engineering, Security Operations, Product, Engineering, Legal, Privacy, and business leaders. Help them include governance and risk in business and technology decisions while they remain responsible for their own areas.
• Develop the GRC team and build a culture of good judgment, technical knowledge, accountability, teamwork, and continuous improvement.

Qualifications

Minimum Qualifications

• Bachelor’s degree in Cybersecurity, Information Security, Information Systems, Risk Management, Business, or a related field.
• 12 or more years of progressive cybersecurity experience, including leadership in strategy, governance, risk, compliance, audit, or related areas.
• 7 or more years of experience leading cybersecurity, GRC, risk, compliance, audit, or security assurance teams.
• Prior substantive, hands-on experience in at least one cybersecurity field outside GRC, such as security architecture, security engineering, security operations, application or product security, or cloud security.
• Experience helping develop cybersecurity strategy and turning it into roadmaps, priorities, plans, and measurable results.
• Experience coordinating work across cybersecurity teams without direct authority over those teams, including managing dependencies, tracking commitments, and resolving or escalating conflicts.
• Experience building and improving enterprise cybersecurity risk, governance, compliance, policy, security awareness, third-party risk, or customer assurance programs.
• Experience with cybersecurity risk registers, risk-rating methods, treatment plans, risk acceptance, policy exceptions, and executive risk reporting.
• Strong knowledge of security controls and common frameworks and requirements, including NIST CSF, SSDF, ISO 27001, SOC 2, and FERPA.
• Experience coordinating internal and external audits, certification work, evidence collection, findings, and remediation tracking.
• Ability to combine cybersecurity metrics and program updates into clear reports for the CISO and executive leadership.
• Strong communication, judgment, and relationship skills, with the ability to work effectively with cybersecurity, Product, Engineering, Legal, Privacy, PMO, and business leaders.

Preferred Qualifications

• Relevant certifications such as CISSP, CISM, CRISC, CISA, or ISO 27001 Lead Implementer or Lead Auditor.
• Experience in SaaS, cloud-native, education technology, or another highly regulated environment.
• Experience working with a shared business PMO to manage enterprise roadmaps, milestones, dependencies, and reporting.
• Experience leading ISO 27001 and SOC 2 programs and supporting customer audits, due diligence reviews, and security questionnaires. Experience with StateRAMP/GovRAMP a plus
• Demonstrated success building strong GRC teams and influencing senior leaders across a large, complex organization.

Compensation & Benefits

Compensation & Benefits

Along with our highly market competitive base compensation, PowerSchool offers the following benefits:

• Comprehensive Insurance Coverage (including Medical, Dental, Vision, Pharmacy benefits, Life Insurance and AD&D)
• Flexible Spending Accounts and Health Savings Accounts
• Short-Term Disability and Long-Term Disability
• Comprehensive 401(k) plan
• Generous Parental Leave
• Unrestricted paid time off (known as Discretionary Time Off - DTO)
• Wellness Program, including ClassPass & Employee Assistance Program
• Tuition Reimbursement
• Optional Benefits: Pet Insurance, Identity Theft Protection, Student Debt Repayment Program and Prepaid Legal coverage

EEO Commitment

EEO Commitment

PowerSchool is committed to a diverse and inclusive workplace. PowerSchool is an equal opportunity employer and does not discriminate on the basis of race, national origin, gender, gender identity, sexual orientation, protected veteran status, disability, age, or other legally protected status. Our inclusive culture empowers PowerSchoolers to deliver the best results for our customers. We not only celebrate the diversity of our workforce, we celebrate the diverse ways we work. If you have a disability and need an accommodation regarding our recruiting process, please let us know by emailing accommodations@powerschool.com.