Director, IT & Security

We're hiring our first Director, IT & Security to build Stepful's IT and security function currently managed by a third party IT admin. You'll own our path to SOC 2 certification and everything that keeps a fast-growing company running securely — from identity and access management to the laptop that lands on every new hire's desk to meeting with client security and IT teams. This is a hands-on role to start: you'll operate as an individual contributor, set the strategy, and build out a team as the company scales.

Responsibilities

Security & Compliance: Own Stepful's security program end to end; Ensure we remain SOC 2 compliant; Define and enforce security policies, identity and access management, and least-privilege controls across the organization (SSO, MFA, access reviews); Support our B2B healthcare partnerships by owning security questionnaires, vendor assessments, and customer audit requests; IT Operations: Own the full equipment lifecycle — procurement, MDM deployment, inventory, and seamless onboarding/offboarding for every employee; Manage our SaaS application stack, including provisioning, access governance, vendor security reviews, and spend optimization; Build scalable IT support processes and serve as the escalation point for day-to-day IT needs, rolling up your sleeves while the function is small; Partner with Engineering on incident response, endpoint security, and infrastructure hardening; Managing the physical IT presence across multiple sites nationwide - NYC office, St. Louis Campus, Lab sites nationwide; Team Building: Define the long-term IT roadmap and build, hire, and lead the team as Stepful's needs grow

Requirements

8+ years of IT experience, including experience leading IT or security functions at a high-growth startup; Hands-on experience driving a SOC 2 certification (Type I and II) from readiness through audit; Deep expertise with the modern IT stack: MDM (e.g., Kandji, Jamf), identity providers (e.g., Okta, Google Workspace), and endpoint security tooling; Proven ability to operate as a strategic leader and a hands-on individual contributor at the same time; Strong vendor management skills across hardware, software, and audit partners; Exceptional communication skills with the ability to make security and compliance accessible to non-technical teams; A builder's mindset — you're energized by creating processes and systems from scratch, not inheriting them

Nice to have

Experience with HIPAA or healthcare data compliance; Built an IT function from zero at a scaling company; Worked in EdTech, healthcare, or another mission-driven industry

Benefits

Meaningful Equity Stake; Subsidized Medical, Dental, and Vision insurance plan options; 401(k); FSA, HSA and commuter benefits; Open vacation policy; 15 days PTO annually; Stepful closed the last week of December; 15 work-from-anywhere days; 10 public holidays observed for 2026