Compliance Analyst

Reports To: Chief Compliance Officer
Location: Bloomington, IN or Indianapolis, IN; remote considered for candidates in the Mountain time zone
Department: Compliance
Classification: Exempt

About Student First Technologies

Student First Technologies builds Theodore, the platform behind education funding programs across the country. Scholarship-granting organizations, state agencies and nonprofits use it to run Education Savings Accounts, tax-credit scholarships and family grants, from application and eligibility through disbursement and reporting. Over more than a decade, Theodore has administered over $1.3 billion in education funds for more than 300,000 students and families in 15+ states.

We believe every child is unique and deserves an education tailored to their gifts and talents. Our software makes that possible at scale: it gives programs the guardrails the law requires, and gives families, schools and vendors an easy way to take part. When a family is approved for a scholarship or pays a tutor from their ESA, that runs through our code.

The work is growing. ESA programs are expanding fast, and the new federal scholarship tax credit takes effect January 1, 2027, bringing donor-funded scholarships to every state that opts in. Programs trust us with public funds and family data, so we hold a SOC 2 Type 2 certification and are audited every year.

Position Summary

The Compliance Analyst owns the day-to-day operation of Student First Technologies’ SOC 2 Type 2 compliance program, keeping the company audit-ready throughout the year rather than only at audit time. This role monitors controls in Drata, gathers and reviews evidence from our security and monitoring tools, manages endpoint device compliance through Rippling, and coordinates the annual penetration test from scoping through remediation. The ideal candidate is detail-oriented, organized, and comfortable working across IT, Engineering, and leadership to make sure our controls work as designed and that we can prove it to auditors and clients.

Key Responsibilities

SOC 2 Type 2 Program Management

• Own the SOC 2 control set in Drata: monitor control health, resolve failing tests, and keep policies, control owners, and evidence current.
• Collect, review, and upload evidence throughout the observation period so the company is audit-ready at all times.
• Serve as the primary point of contact for external SOC 2 auditors, including fieldwork scheduling, evidence requests, and follow-up questions.
• Track exceptions and audit findings to closure and document management responses.
• Run recurring control activities, including quarterly access reviews, policy acknowledgments, security awareness training, and vendor risk reviews.

Security Tooling and Evidence

• Pull and review evidence from Blumira (SIEM) to demonstrate log collection, alerting, and incident detection and response controls.
• Use DNSFilter reporting to evidence web content filtering and threat-blocking controls, and flag policy gaps.
• Work with Engineering to use New Relic data as evidence for availability, performance monitoring, and change and incident management controls.
• Partner with IT and Engineering to confirm integrations between these tools and Drata remain connected and accurate.

Device and Endpoint Controls

• Monitor endpoint device controls through Rippling MDM, including disk encryption, OS patching, screen lock, antivirus, and device inventory.
• Follow up with employees on non-compliant devices and escalate unresolved issues.
• Coordinate device lifecycle controls with IT, including enrollment at onboarding and device retrieval or remote wipe at offboarding.

Annual Penetration Test

• Coordinate the annual penetration test, including vendor engagement, scoping, rules of engagement, and scheduling.
• Triage findings with Engineering, assign owners and due dates based on severity, and track remediation to completion.
• Arrange retesting as needed and maintain the report and remediation evidence for auditors and clients.

Risk, Policy, and Client Trust

• Maintain the risk register and lead the annual risk assessment.
• Draft and update security and compliance policies, procedures, and the incident response plan.
• Respond to client security questionnaires and due diligence requests, partnering with Client Management as needed.
• Exercise sound judgment regarding when independent action is appropriate and when leadership involvement is necessary.

Required Qualifications & Experience

• 2 to 4 years of experience in IT compliance, security GRC, or IT audit.
• Hands-on experience supporting at least one SOC 2 Type 2 audit, including evidence collection and auditor coordination.
• Working knowledge of the AICPA Trust Services Criteria and common security controls (access management, change management, logging, vulnerability management, incident response).
• Experience with a compliance automation platform such as Drata, Vanta, or Secureframe.
• Comfort reading security tool output, such as SIEM alerts, DNS logs, MDM reports, and monitoring dashboards, well enough to judge whether it satisfies a control.
• Clear, organized writing for policies, audit responses, and customer questionnaires.
• Strong follow-through: you track many open items across teams and close them on time.
• Bachelor’s degree in Information Systems, Cybersecurity, Accounting, Business, or a related field, or equivalent professional experience.
• Ability to maintain confidentiality and handle sensitive information professionally.

Preferred Qualifications

• Direct experience with Drata, Rippling, Blumira, DNSFilter, or New Relic.
• Experience managing penetration test vendors and remediation tracking.
• Familiarity with other frameworks such as ISO 27001, NIST CSF, or FERPA.
• A certification such as CISA, CompTIA Security+, CRISC, or ISO 27001 Lead Implementer, or willingness to pursue one.
• Experience in a SaaS or cloud-hosted environment (AWS, Azure, or GCP).
• Familiarity with education funding programs or K–12 education systems is a plus.

Key Competencies

• Attention to Detail and Accuracy
• Security and Compliance Knowledge
• Organization and Follow-Through
• Analytical and Risk-Based Thinking
• Collaboration and Communication
• Integrity and Discretion
• Continuous Learning

Success Factors

• Continuous Audit Readiness
• Clean SOC 2 Type 2 Audit Outcomes
• Timely Remediation of Findings
• Accurate and Complete Evidence
• Effective Cross-Functional Collaboration
• Proactive Risk Identification
• Continuous Learning and Growth

Work Environment & Expectations

• Work Type: Hybrid.
• Travel Requirements: Occasional. There might be occasional travel for team meetings or retreats, conferences or training events, and on-site meetings with auditors or clients.
• Physical Requirements: Primarily sedentary. The role is largely sedentary, involving prolonged periods of sitting at a desk, using a computer and keyboard/mouse, and participating in virtual meetings.
• Visual Acuity: Close visual acuity is essential for reading documentation, reports, and screens.

Performance Metrics & Evaluation

• Drata control health and percentage of passing controls
• SOC 2 Type 2 audit results, including number of exceptions
• Penetration test findings remediated within agreed timelines
• Endpoint device compliance rate in Rippling
• Timeliness of recurring control activities and client questionnaire responses

Company Values & Cultural Fit

The Compliance Analyst directly supports SFT’s mission of putting students first by protecting the data and systems that school choice organizations, students, and families rely on. By keeping our security controls strong and verifiable, this role builds the trust that allows clients to partner with Student First Technologies with confidence. Success in this role requires a commitment to our core values of Students Come First, Exceptional People, Collaborative Partnerships, Innovative Products, Pursuit of Excellence, and Empowering Solutions.

How to Apply

If you are interested, please email team@studentfirsttech.com.

Disclaimer

This job description outlines the current duties and responsibilities associated with the position. Please note that the tasks and expectations are subject to change due to evolving company needs, policies, and leadership direction. The company reserves the right to modify job duties and responsibilities as necessary to meet its operational, strategic, and organizational objectives.

‍