PowerSchool Group

AI-driven cloud-based K-12 education software platform

Director – Information Security

Security Governance, Risk & CompliancePosted on Nov 12

Full-timePlano, TX, USANo salary listedIn-person

About the Job

Requirements

A bachelor's degree in Cybersecurity, Information Security, Information Systems, Risk Management, Business, or a related field is required.
At least 12 years of progressive cybersecurity experience, including leadership in strategy, governance, risk, compliance, audit, or related areas, is required.
At least 7 years of experience leading cybersecurity, GRC, risk, compliance, audit, or security assurance teams is required.
Prior substantive, hands-on experience in at least one cybersecurity field outside GRC, such as security architecture, security engineering, security operations, application or product security, or cloud security, is required.
Experience helping develop cybersecurity strategy and translating it into roadmaps, priorities, plans, and measurable results is required.
Experience coordinating work across cybersecurity teams without direct authority, including managing dependencies, tracking commitments, and resolving or escalating conflicts, is required.
Experience building and improving enterprise cybersecurity risk, governance, compliance, policy, security awareness, third-party risk, or customer assurance programs is required.
Experience with cybersecurity risk registers, risk-rating methods, treatment plans, risk acceptance, policy exceptions, and executive risk reporting is required.
Strong knowledge of security controls and common frameworks and requirements, including NIST CSF, SSDF, ISO 27001, SOC 2, and FERPA, is required.
Experience coordinating internal and external audits, certification work, evidence collection, findings, and remediation tracking is required.
Ability to combine cybersecurity metrics and program updates into clear reports for the CISO and executive leadership is required.
Strong communication, judgment, and relationship skills are required to work effectively with cybersecurity, Product, Engineering, Legal, Privacy, PMO, and business leaders.

Responsibilities

Work with the CISO and other cybersecurity leaders to develop the company's cybersecurity strategy and translate it into a clear roadmap covering major projects, operational improvements, audit fixes, risk reduction plans, and security investments.
Maintain the cybersecurity roadmap, set criteria for work included on it, coordinate priorities and dependencies across security teams, and recommend solutions to the CISO when priorities conflict.
Plan and lead regular cybersecurity leadership meetings for strategy, planning, progress reviews, and reporting; track decisions and commitments, follow up on action items, and raise major delays or gaps to the CISO.
Serve as the main cybersecurity contact for the shared business PMO and help translate security priorities into plans, milestones, dependencies, resource needs, and status updates.
Set and enforce common standards for cybersecurity planning and reporting; combine metrics and updates from security leaders, identify cross-team trends and risks, and prepare updates for the CISO and executive leadership.
Lead the Governance, Risk, and Compliance organization, covering security risk, compliance, policies and standards, third-party risk, security awareness, ISO 27001 and SOC 2 audits, customer security assurance, and security control governance.
Work with security and business leaders to develop a common method for rating cybersecurity risk; maintain the security risk register and support consistent risk reviews, priorities, treatment plans, and reporting.
Set and maintain rules for accepting security risks and approving policy exceptions; review requests, recommend decisions based on approved authority levels, and track accepted risks, exceptions, and required fixes.
Lead security control governance by maintaining the control framework, defining control goals and evidence needs, monitoring control coverage and fixes, and coordinating testing with Internal Audit, external auditors, and control owners.
Manage cybersecurity relationships with Internal Audit and external ISO 27001 and SOC 2 auditors; coordinate audit schedules, evidence, interviews, findings, corrective actions, and certification milestones.
Maintain security policies, compliance programs, third-party risk processes, security awareness programs, and customer security assurance services, ensuring they support business goals, legal duties, customer commitments, and continuous improvement.
Work with Security Architecture, Security Engineering, Security Operations, Product, Engineering, Legal, Privacy, and business leaders to incorporate governance and risk into business and technology decisions while each group remains responsible for its own area.
Develop the GRC team and build a culture of good judgment, technical knowledge, accountability, teamwork, and continuous improvement.

Desired Qualifications

Relevant certifications such as CISSP, CISM, CRISC, CISA, or ISO 27001 Lead Implementer or Lead Auditor are preferred.
Experience in SaaS, cloud-native, education technology, or another highly regulated environment is preferred.
Experience working with a shared business PMO to manage enterprise roadmaps, milestones, dependencies, and reporting is preferred.
Experience leading ISO 27001 and SOC 2 programs and supporting customer audits, due diligence reviews, and security questionnaires is preferred; StateRAMP/GovRAMP experience is a plus.
Demonstrated success building strong GRC teams and influencing senior leaders across a large, complex organization is preferred.

Overview

About PowerSchoolAt PowerSchool, we power education for students around the world. As the global leader in cloud-based K-12 software, we support the full education ecosystem—from the central office to the classroom to the home. Joining PowerSchool means being part of a mission-driven team that is transforming K-12 education by helping schools operate more effectively and deliver better outcomes for educators, students, and families.

About the position

The Director of Cybersecurity Strategy and Governance reports directly to the CISO and serves as a senior advisor on cybersecurity strategy, governance, risk, and program execution. In partnership with the CISO and cybersecurity leaders, this role helps formulate enterprise cybersecurity strategy and drives coordinated execution by maintaining the consolidated cybersecurity roadmap, establishing the leadership planning and reporting cadence, managing cross-functional dependencies, and partnering closely with the business PMO. The Director leads the Governance, Risk, and Compliance organization, including cybersecurity risk management, compliance, policy and standards, third-party risk management, security awareness, ISO 27001 and SOC 2 audit coordination, customer security assurance, and security control governance. Working collaboratively with the leaders of security architecture, security engineering, security operations, Product, Legal, Privacy, and other business functions, the Director strengthens execution, enables risk-informed decisions, and prepares consolidated cybersecurity updates for the CISO and executive leadership while preserving each leader’s accountability and decision authority within their domain.

Responsibilities

Description

Your day-to-day job will consist of:

Work with the CISO and other cybersecurity leaders to develop the company’s cybersecurity strategy and turn it into a clear roadmap. The roadmap will include major projects, operational improvements, audit fixes, risk reduction plans, and security investments.
Maintain the cybersecurity roadmap. Set the rules for which work belongs on it, coordinate priorities and dependencies across security teams, and recommend solutions to the CISO when priorities conflict.
Plan and lead regular cybersecurity leadership meetings for strategy, planning, progress reviews, and reporting. Track decisions and commitments, follow up on action items, and raise major delays or gaps to the CISO.
Serve as the main cybersecurity contact for the shared business PMO. Help turn security priorities into clear plans, milestones, dependencies, resource needs, and status updates.
Set and enforce common standards for cybersecurity planning and reporting. Combine metrics and updates from security leaders, identify trends and risks across teams, and prepare updates for the CISO and executive leadership.
Lead the Governance, Risk, and Compliance organization. This includes security risk, compliance, policies and standards, third-party risk, security awareness, ISO 27001 and SOC 2 audits, customer security assurance, and security control governance.
Work with security and business leaders to develop a common method for rating cybersecurity risk. Maintain the security risk register and support consistent risk reviews, priorities, treatment plans, and reporting.
Set and maintain rules for accepting security risks and approving policy exceptions. Review requests, recommend decisions based on approved authority levels, and track accepted risks, exceptions, and required fixes.
Lead security control governance. Maintain the control framework, define control goals and evidence needs, monitor control coverage and fixes, and coordinate testing with Internal Audit, external auditors, and control owners.
Manage cybersecurity relationships with Internal Audit and external ISO 27001 and SOC 2 auditors. Coordinate audit schedules, evidence, interviews, findings, corrective actions, and certification milestones.
Maintain security policies, compliance programs, third-party risk processes, security awareness programs, and customer security assurance services. Make sure these programs support business goals, legal duties, customer commitments, and ongoing improvement.
Work closely with Security Architecture, Security Engineering, Security Operations, Product, Engineering, Legal, Privacy, and business leaders. Help them include governance and risk in business and technology decisions while they remain responsible for their own areas.
Develop the GRC team and build a culture of good judgment, technical knowledge, accountability, teamwork, and continuous improvement.

Qualifications

Minimum Qualifications

Bachelor’s degree in Cybersecurity, Information Security, Information Systems, Risk Management, Business, or a related field.
12 or more years of progressive cybersecurity experience, including leadership in strategy, governance, risk, compliance, audit, or related areas.
7 or more years of experience leading cybersecurity, GRC, risk, compliance, audit, or security assurance teams.
Prior substantive, hands-on experience in at least one cybersecurity field outside GRC, such as security architecture, security engineering, security operations, application or product security, or cloud security.
Experience helping develop cybersecurity strategy and turning it into roadmaps, priorities, plans, and measurable results.
Experience coordinating work across cybersecurity teams without direct authority over those teams, including managing dependencies, tracking commitments, and resolving or escalating conflicts.
Experience building and improving enterprise cybersecurity risk, governance, compliance, policy, security awareness, third-party risk, or customer assurance programs.
Experience with cybersecurity risk registers, risk-rating methods, treatment plans, risk acceptance, policy exceptions, and executive risk reporting.
Strong knowledge of security controls and common frameworks and requirements, including NIST CSF, SSDF, ISO 27001, SOC 2, and FERPA.
Experience coordinating internal and external audits, certification work, evidence collection, findings, and remediation tracking.
Ability to combine cybersecurity metrics and program updates into clear reports for the CISO and executive leadership.
Strong communication, judgment, and relationship skills, with the ability to work effectively with cybersecurity, Product, Engineering, Legal, Privacy, PMO, and business leaders.

Preferred Qualifications

Relevant certifications such as CISSP, CISM, CRISC, CISA, or ISO 27001 Lead Implementer or Lead Auditor.
Experience in SaaS, cloud-native, education technology, or another highly regulated environment.
Experience working with a shared business PMO to manage enterprise roadmaps, milestones, dependencies, and reporting.
Experience leading ISO 27001 and SOC 2 programs and supporting customer audits, due diligence reviews, and security questionnaires. Experience with StateRAMP/GovRAMP a plus
Demonstrated success building strong GRC teams and influencing senior leaders across a large, complex organization.

Compensation & Benefits

Along with our highly market competitive base compensation, PowerSchool offers the following benefits:

Comprehensive Insurance Coverage (including Medical, Dental, Vision, Pharmacy benefits, Life Insurance and AD&D)
Flexible Spending Accounts and Health Savings Accounts
Short-Term Disability and Long-Term Disability
Comprehensive 401(k) plan
Generous Parental Leave
Unrestricted paid time off (known as Discretionary Time Off - DTO)
Wellness Program, including ClassPass & Employee Assistance Program
Tuition Reimbursement
Optional Benefits: Pet Insurance, Identity Theft Protection, Student Debt Repayment Program and Prepaid Legal coverage

EEO Commitment

PowerSchool is committed to a diverse and inclusive workplace. PowerSchool is an equal opportunity employer and does not discriminate on the basis of race, national origin, gender, gender identity, sexual orientation, protected veteran status, disability, age, or other legally protected status. Our inclusive culture empowers PowerSchoolers to deliver the best results for our customers. We not only celebrate the diversity of our workforce, we celebrate the diverse ways we work. If you have a disability and need an accommodation regarding our recruiting process, please let us know by emailing [email protected].

About the Company

PowerSchool Group

AI-driven cloud-based K-12 education software platform

PowerSchool provides cloud-based K-12 education software that helps schools, districts, and ministries manage instructional planning, data management, attendance, grades, and communication in one platform. Its product combines multiple school operations into a single suite and uses AI to support personalized learning and data-driven decision making. The platform is subscription-based with services, designed to scale across regions (North America, India, Asia Pacific) and to comply with state regulations, enabling long-term partnerships and ongoing upselling opportunities. PowerSchool differentiates itself by offering an integrated, scalable solution that covers both administrative tasks and instructional tools, aiming to improve student success and streamline digital modernization in education.

Company size: 1,001-5,000
Company stage: IPO
Headquarters: Folsom, CA
Founded: 1997

Recently Posted Jobs

Explore more opportunities at PowerSchool Group

See more jobs