Director, IT & Security

Stepful; New York (NY); Hybrid; USD 200,000 - 250,000; Full time

Benefits offered by this job

Meaningful Equity Stake

Subsidized Medical, Dental, Vision

401(k)

FSA/HSA and commuter benefits

Open vacation policy

PTO and remote-work days

Job summary

Stepful, a workforce platform redefining healthcare talent pipelines, is hiring its first Director of IT & Security in New York City. You will own security and IT operations from identity management to device provisioning, and you’ll shape strategy while hands-on as the company scales.

You’ll lead SOC 2 readiness, build a team as operations grow, and partner with Engineering, Finance, People, and B2B groups. This hybrid role requires three days in the NYC office weekly.

Qualifications

• 8+ years of IT experience, including leadership at a high-growth startup.
• Hands-on SOC 2 certification experience (Type I & II) from readiness through audit.
• Deep expertise with MDM, identity providers, and endpoint security tooling.
• Strategic leader who is also a hands-on individual contributor.
• Strong vendor management across hardware, software, and audit partners.
• Exceptional communication with non-technical teams.
• Builder's mindset – create processes and systems from scratch.

Responsibilities

• Own Stepful's security program end to end.
• Maintain SOC 2 compliance.
• Define and enforce security policies, IAM, and least-privilege controls.
• Own security questionnaires, vendor assessments, and customer audit requests.
• Own the full equipment lifecycle including procurement and onboarding.
• Manage SaaS stack: provisioning, access governance, vendor reviews, spend optimization.
• Build scalable IT support processes and act as escalation point.
• Partner with Engineering on incident response and infrastructure hardening.
• Manage physical IT presence across NYC, St. Louis Campus, and lab sites.
• Define long-term IT roadmap and build/lead the team.

Skills

Strategic leadership

Hands-on contributor

Vendor management

Excellent communication

Builder's mindset

Security awareness

Tools

MDM (Kandji/Jamf)

Identity providers (Okta/GSuite)

Endpoint security tooling

Job description

About Stepful:

Stepful is a workforce platform redefining how America's largest health systems build, train, and retain their talent. Since our founding in 2021, Stepful’s trained over 32,000 practice-ready healthcare workers.

Layering onto our successful direct-to-consumer training, Stepful partners with leading healthcare institutions to address the growing national shortage of healthcare workers. We’re improving access to quality healthcare for everyone, everywhere, and improving access to healthcare career ladders for those who need them most.

Our students form the talent pipelines for major employers such as NY-Presbyterian, Mt. Sinai, HCA, Providence, CVS, and Walgreens. We have partnerships with half of the top 10 health systems in the US and are in process with many more.

Stepful is backed by Y Combinator, Reach Capital, and AlleyCorp, with a recent $55M Series C led by Oak HC/FT. We were named the #1 EdTech company in the U.S. by TIME for 2025.

Our values:

• Care first: We do whatever it takes for our students to succeed.
• Learn quickly: We test, learn with data, and iterate.
• Build together: We win when we rely on each other.
• Own it: We show up, take initiative, and show pride.

The opportunity:

We're hiring our first Director, IT & Security to build Stepful's IT and security function currently managed by a third party IT admin. You'll own our path to SOC 2 certification and everything that keeps a fast-growing company running securely — from identity and access management to the laptop that lands on every new hire's desk to meeting with client security and IT teams. This is a hands-on role to start: you'll operate as an individual contributor, set the strategy, and build out a team as the company scales.

This role reports directly to the SVP, Engineering and partners closely with Engineering, Finance, People, and our B2B teams across the organization.

This is a hybrid opportunity based out of our NYC office, requiring three days/week (Tuesday, Wednesday, Thursday) in office.

What you'll do:

• Security & Compliance: Own Stepful's security program end to end
• Ensure we remain SOC 2 compliant
• Define and enforce security policies, identity and access management, and least-privilege controls across the organization (SSO, MFA, access reviews)
• Support our B2B healthcare partnerships by owning security questionnaires, vendor assessments, and customer audit requests
• IT Operations: Own the full equipment lifecycle — procurement, MDM deployment, inventory, and seamless onboarding/offboarding for every employee
• Manage our SaaS application stack, including provisioning, access governance, vendor security reviews, and spend optimization
• Build scalable IT support processes and serve as the escalation point for day-to-day IT needs, rolling up your sleeves while the function is small
• Partner with Engineering on incident response, endpoint security, and infrastructure hardening
• Managing the physical IT presence across multiple sites nationwide - NYC office, St. Louis Campus, Lab sites nationwide
• Team Building: Define the long-term IT roadmap and build, hire, and lead the team as Stepful's needs grow

What you'll bring:

• 8+ years of IT experience, including experience leading IT or security functions at a high-growth startup
• Hands-on experience driving a SOC 2 certification (Type I and II) from readiness through audit
• Deep expertise with the modern IT stack: MDM (e.g., Kandji, Jamf), identity providers (e.g., Okta, Google Workspace), and endpoint security tooling
• Proven ability to operate as a strategic leader and a hands-on individual contributor at the same time
• Strong vendor management skills across hardware, software, and audit partners
• Exceptional communication skills with the ability to make security and compliance accessible to non-technical teams
• A builder's mindset — you're energized by creating processes and systems from scratch, not inheriting them

Bonus points if:

• You have experience with HIPAA or healthcare data compliance
• You've built an IT function from zero at a scaling company
• You've worked in EdTech, healthcare, or another mission-driven industry

Interview Process:

• Introductory call with Talent Acquisition team member
• Interview with Hiring Manager
• Take-Home Assignment and Presentation
• On-Site Panel Interview

Benefits and Compensation:

• Meaningful Equity Stake
• Subsidized Medical, Dental, and Vision insurance plan options
• 401(k)
• FSA, HSA and commuter benefits
• Open vacation policy, including:
  • Guidance of 15 days PTO annually
  • Stepful closed the last week of December
  • 15 work-from-anywhere days
  • 10 public holidays observed for 2026

The target base salary range for this opportunity is $200,000 - $250,000, and is part of a competitive total rewards package including equity and benefits. Individual pay may vary from the target range and is determined by a number of factors including experience, internal pay equity and other relevant business considerations.

Stepful is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex, marital status, ancestry, disability, genetic information, veteran status, gender identity or expression, sexual orientation, pregnancy, or other applicable legally protected characteristic.