Cybersecurity leadership in a school district

School districts do not call it CISO. They call it Executive Director of Cybersecurity, or Senior Executive Director, or Chief Technology Officer with security folded in. The title confuses people coming from industry, and it costs districts candidates who scroll past a posting that would have interested them under a different name.

The work underneath is recognizable. What is not recognizable, to most people arriving from a bank or a software company, is the regulatory shape of it, the size of the data, and who you answer to when something goes wrong.

In Texas this is a job the law requires

Most states encourage districts to take security seriously. Texas writes it into the Education Code. Section 11.175, headed School Cybersecurity, was added by Senate Bill 820 in 2019, took effect September 1 of that year, and has been amended three times since, in 2021 twice and again in 2023.

Read as a job description, it says this:

• The district adopts a cybersecurity policy. Two purposes are named. Secure district cyberinfrastructure against cyber attacks and other cybersecurity incidents, and determine cybersecurity risk and implement mitigation planning. That second clause is a risk-management mandate, not an IT one.
• The policy may not conflict with the information security standards the Department of Information Resources adopts for institutions of higher education under Government Code chapters 2054 and 2059. A K-12 security program in Texas is therefore anchored to a state standard written for universities.
• The superintendent designates a cybersecurity coordinator to serve as a liaison between the district and the agency. One named person, designated by the superintendent, is the point of contact with the Texas Education Agency.
• Breaches get reported to the agency as soon as practicable after discovery.
• Parents get told. The coordinator provides notice to a parent of or person standing in parental relation to a student whose information was involved. Not a press release. A notice to that child's family.
• There is a state information-sharing system. TEA and DIR maintain one that carries every report, shares it in near real time, and keeps the reporting district's name undisclosed.
• The coordinator takes annual training under Government Code section 2054.5191. The statute is specific that only the coordinator must; everyone else is trained as the district decides, in consultation with the coordinator.

If you take one of these roles in Texas, you are very likely the designated coordinator. That is a named statutory position with a reporting duty and a parent-notification duty attached to your office. It is closer to a compliance officer's accountability than to a security engineer's.

The data is the job

A district of any size holds records that a mid-market company would consider a nightmare to protect. Names, dates of birth and home addresses for children. Immigration and homeless status. Special education evaluations and the disability diagnoses inside them. Free and reduced lunch eligibility, which is a household income declaration. Discipline records. Health records held by the school nurse. Counseling notes.

Three federal regimes sit on top of it. FERPA governs education records and parent access rights. PPRA governs surveys and the collection of certain categories of information from students. COPPA, enforced by the Federal Trade Commission, governs online services directed to children under 13, which is most of what an elementary school uses.

And almost none of that data sits in a system the district wrote. It sits in a student information system, a learning management system, an assessment platform, a transportation router, a cafeteria point of sale, a behavior tracker, and whatever a teacher signed up for on a Tuesday because it looked useful. Every one of those is a vendor with a contract, a data sharing agreement, a retention promise and a breach history.

Which is why the strongest candidates for these jobs increasingly come from data governance and privacy rather than from the network closet. The question is rarely whether the firewall holds. It is who approved this vendor, what they are allowed to do with the records, how long they keep them, and whether anyone can prove any of it.

What the federal government actually gives you

CISA publishes for this sector specifically, and the material is free. Worth knowing by name, because a hiring panel will mention it:

• Protecting Our Future: Partnering to Safeguard K–12 organizations from Cybersecurity Threats, published January 2023. The report that set the federal posture toward districts.
• K-12 Cybersecurity Foundations Resource Package, a set of guides, videos and supplemental material aimed at prevention, mitigation and response.
• Cybersecurity Guidance for K-12 Technology Acquisitions, which is about buying Secure by Design products. Procurement, in other words, which is where most of a district's risk is actually decided.
• K-12 Education Technology Secure by Design Pledge, which edtech vendors can sign. Checking whether a vendor has is a reasonable interview question to ask in either direction.
• Stop Ransomware K-12 Resources, written for staff, parents and students rather than for engineers.

Everything above is on CISA's K-12 cybersecurity page at no cost. A candidate who has read the Foundations package before the interview is ahead of most of the room.

Why someone from industry should look at this seriously

The budget will be smaller than you are used to. That is the honest headline and there is no point dressing it up.

What you get instead: scope that would take fifteen years to reach in a corporation. You will own the whole program. There is no separate GRC team, no separate privacy office, no separate vendor risk function, no managed detection contract absorbing the hard parts. You write the policy, you run the vendor reviews, you brief the board, you handle the incident, and you are the name on the report to the state.

You also brief in public. District board meetings are open. The security program gets discussed in a room with parents in it. People who are good at that become unusually good at executive communication, because they have had to do it without the cover of a closed boardroom.

And the sector hires continuously. Districts are the largest employer in a great many American counties, there are roughly thirteen thousand of them, and the statutory pressure in states like Texas is pushing the work from a shared duty toward a named full-time seat.

What these postings ask for

Across district postings at this level, the pattern is consistent. A bachelor's degree, often with a master's preferred. Five to ten years in information security with some of it in leadership. One of CISSP, CISM or CISA, with CISM showing up most often because the job is management rather than engineering. Familiarity with NIST frameworks. And, increasingly, experience with vendor risk, because that is where the losses have come from.

What rarely appears and probably should: experience with FERPA, with student data privacy specifically, or with public sector procurement. Districts tend to assume they will teach that. Candidates who already have it should say so loudly, because the panel will not have thought to ask.

Free practice material for the three certifications above is in our certification academy, including CISM. The cybersecurity and GRC career guides cover how people reach security leadership from the compliance side, and the CISO career guide covers the corporate equivalent of this seat.

Where the next one gets posted

District security roles are advertised on the district's own site, on regional service center boards, and on general boards under enough different titles that a saved search on "CISO" will miss most of them. Searching on the work rather than the title is what finds them.

On this board: cybersecurity and IT GRC jobs, CISO and security leadership, data governance, privacy, and GRC leadership. By place, Texas and Dallas and Fort Worth. A job alert is the practical answer, because these appear and close inside a few weeks. The one that was at this address was open for five days.

Frequently asked questions

Is the Fort Worth ISD Senior Executive Director of Cybersecurity job still open?

No. That posting ran on this board in September 2026 and the district has since taken it down. Current openings are on the cybersecurity jobs and CISO jobs pages, and a job alert will catch the next one.

What does a Senior Executive Director of Cybersecurity do in a school district?

The same work a CISO does in a company, with a different title and a wider span. One person usually owns policy, vendor and edtech risk, incident response, board reporting and student data protection, because districts rarely staff those as separate functions.

Does Texas law require school districts to have a cybersecurity leader?

Texas Education Code section 11.175 requires every district to adopt a cybersecurity policy and requires the superintendent to designate a cybersecurity coordinator as the district's liaison with the Texas Education Agency. That coordinator reports breaches to the agency, notifies the parents of affected students, and completes annual training under Government Code section 2054.5191.

What certification is worth most for these roles?

CISM appears most often in district postings at this level, because the job is management rather than engineering. CISSP and CISA are both common alternatives. Free practice questions for all three are in the certification academy on this site.

Can someone move into K-12 security from privacy or data governance?

Yes, and it is becoming the more common route. Most of the risk in a district sits in vendor contracts, data sharing agreements and retention rather than in the network, so FERPA and student data privacy experience is worth more than it usually gets credit for.

By F. Jay Hall, founder of GRC Careers and ExecSearches.com, recruiting into governance, risk and compliance since 1999. Published October 23, 2026.