Vice President, Information Security

Strada Education Foundation•Washington, DC

2d•Onsite

About The Position

CredLens is a nonprofit national data trust that connects issuer-verified non-degree credential records to employment, earnings, and education outcomes. The Vice President, Information Security will operate and scale CredLens’ mature security program as the organization expands adoption among issuers, state agencies, and higher education. The role is based in Washington, D.C., reports to the Chief Technology Officer, and includes approximately 10% travel. The position runs day-to-day security operations, compliance, and controls assurance across a program with SOC 2 Type II reports, ISO 27001 and ISO 27018 certifications, and TX-RAMP Level 2 certification. It also develops a multi-year strategy for privacy-enhancing technologies and data-layer privacy, and makes security assurance a practical enabler of customer and partner growth. The Vice President prepares risk and program reporting for the CredLens Board and Cyber Governance Committee, leads incident response, oversees cloud security across AWS and Snowflake, and manages third-party security relationships. The role leads the DevSecOps Engineer, coordinates specialist firms and an independent Technology and Security Advisory Board, oversees the security program for Digital Credentials Commons as a covered entity, and advises Strada Education Foundation on its SOC 2 Type II program.

Requirements

Bachelor's degree; field of study is not specified.
One or more of the following certifications: CISSP, CCSP, CISM, CISA, CIPP, or CIPM.
At least 10 years of information security experience, including at least 5 years leading a security program with budget, staffing, and audit accountability.
Track record operating and maturing a certified program, including maintaining SOC 2 Type II and ISO 27001 through multiple audit cycles.
Hands-on security leadership in a cloud-native AWS environment, including account architecture, identity and access, logging, and continuous control monitoring tooling.
Experience as an incident commander, including tabletop exercises, severity-based response, breach notification, and retrospectives.
Experience protecting highly sensitive personal data under contractual and regulatory constraints, such as FERPA, state breach-notification laws, and data-partner agreements.
Customer-facing security experience, including trust centers, security questionnaires, and due-diligence conversations with institutional buyers.
Experience managing third-party risk and specialist security vendors.
Experience presenting security risk and program status to a board or executive governance committee.
Operator mindset: able to run, measure, and improve a repeatable program.
Technical depth and comfort working directly in security tooling and cloud consoles alongside a small engineering team.
Strategic judgment in shaping and sequencing a multi-year privacy technology roadmap dependent on partners and agreements.
Clear communication, including producing concise board-ready materials and translating technical risk for executives, clients, auditors, and partners.
Commercial awareness, matching security investment to validated market demand and treating security assurance as a growth enabler.
Sound judgment on risk acceptance, escalation, and disruptive containment decisions.
Comfort with ambiguity and the pace of a high-growth organization.
Alignment with CredLens' mission and guiding values, commitment to a healthy workplace culture, and ability to work collaboratively.

Nice To Haves

Advanced degree.
Interest or experience in data-layer privacy technologies, including tokenization, hashing, field-level encryption, and privacy-preserving record linkage.
Experience with state and federal assurance frameworks such as TX-RAMP, StateRAMP, GovRAMP, NIST 800-53, and NIST CSF.
Experience with application and product security tooling, including code scanning, secret detection, and dependency hardening, and with DevSecOps practices.
Background in EdTech, education, workforce development, or data-platform organizations, including higher education and state agency security reviews.
Experience in a startup, growth-stage, or nonprofit environment as a player-coach.
Experience establishing AI governance and acceptable-use controls.

Responsibilities

Run the information security management system, including continuous control monitoring, vulnerability management and remediation, quarterly access reviews, external-transfer approvals, vendor assessments, policy upkeep, and security and data-handling training.
Maintain SOC 2 Type II, ISO 27001, ISO 27018, and TX-RAMP certifications and reports without major findings; manage auditor, penetration-test, internal-audit, and privacy-assessment relationships and the annual re-test calendar.
Serve as incident commander; own the incident response plan, run annual technical and executive tabletop and disaster recovery/business continuity exercises, coordinate notification commitments with Legal, and drive corrective actions to closure.
Oversee cloud security across AWS and Snowflake, including the PII enclave, account separation, identity and access controls, logging, and backup integrity.
Set the multi-year privacy-enhancing technology strategy across the platform and data-partner ecosystem, including tokenization, privacy-preserving record linkage, and encryption of sensitive fields.
Partner with the CTO on roadmap priorities and the VP, Legal and Data Protection on partner agreements and pilots; engage the Technology and Security Advisory Board on method selection.
Advance data-minimization principles established by the Cyber Governance Committee and extend independent privacy assurance based on the Privacy Impact Assessment and SOC 2 program.
Own the Trust Center, HECVAT and questionnaire responses, and customer security reviews to support efficient customer due diligence.
Manage data-partner security relationships and third-party risk across data brokers, matching partners, and the IRS intermediary; review partner interfaces and transfer controls.
Lead a NIST 800-53 gap assessment and GovRAMP/StateRAMP readiness, and pursue certification when Sales validates demand.
Support DCUA onboarding by incorporating security and privacy requirements into new agreements.
Prepare and present quarterly retrospectives and look-aheads to the CredLens Board; escalate confirmed breaches and high-severity incidents between meetings.
Staff the quarterly Cyber Governance Committee, covering risk appetite, policy exceptions, audit and test findings, incident retrospectives, and the annual risk assessment.
Engage the Technology and Security Advisory Board semi-annually on roadmap and tool choices.
Represent CredLens in Strada's enterprise-wide NIST CSF assessment and December enterprise risk review, and maintain alignment with Strada GRC requirements.
Own AI governance, including responsible-use frameworks, security review of AI vendors, and controls for the managed enterprise AI workspace.
Lead and develop the DevSecOps Engineer; plan security-domain staffing, budget, and spending.
Manage specialist partners for audit, penetration testing and secure code review, internal audit and GRC, forensics, and cyber insurance, including the Mandiant retainer and insurer notice duties.
Run the security program for Digital Credentials Commons as a covered entity, beginning with vulnerability assessment and extending controls as appropriate.
Advise Strada Education Foundation on its SOC 2 Type II program, sharing CredLens practices and lessons learned.