Vice President, Information Security

Strada Education Foundation•Washington, DC

4d•$201,300 - $222,850•Onsite

About The Position

CredLens is a nonprofit national data trust that connects issuer-verified credential records to real-world employment, earnings, and education outcomes. The Vice President, Information Security will operate and scale CredLens’ mature security program as the organization grows its adoption among issuers, state agencies, and higher education. The role reports to the Chief Technology Officer and works closely with the VP, Legal and Data Protection, who is also Chief Privacy Officer. It is supported by a small core team, specialist firms, and an independent Technology and Security Advisory Board, and directly supports the Cyber Governance Committee and CredLens Board. The position is responsible for day-to-day security operations, compliance and controls assurance; privacy-enhancing technology and data-layer privacy strategy; customer and partner security assurance; governance, risk and board reporting; and team and vendor leadership. The role will maintain existing certifications and audit reports, manage incident response, oversee cloud security across AWS and Snowflake, and develop privacy-enhancing technology strategy. It will also help security accelerate customer due diligence and support affiliated programs and Strada Education Foundation. This is a full-time position based in Washington, D.C., with approximately 10% travel. CredLens describes the role as an operator and scaler position at a growth-stage organization, with an emphasis on making security a growth enabler while protecting sensitive data and supporting the organization’s mission.

Requirements

Bachelor’s degree; field of study is not specified, and demonstrated capability and learning agility are valued.
One or more of the following certifications: CISSP, CCSP, CISM, CISA, CIPP, or CIPM.
At least 10 years of information security experience, including at least 5 years leading a security program with budget, staffing, and audit accountability.
Track record of operating and maturing a certified program, including maintaining SOC 2 Type II and ISO 27001 through multiple audit cycles.
Hands-on security leadership in a cloud-native AWS environment, including account architecture, identity and access, logging, and continuous control monitoring tooling.
Experience as an incident commander, including tabletop exercises, severity-based response, breach notification, and retrospectives.
Experience protecting highly sensitive personal data under contractual and regulatory constraints, such as FERPA, state breach-notification laws, and data-partner agreements.
Customer-facing security experience with trust centers, security questionnaires, and due-diligence conversations with institutional buyers.
Experience managing third-party risk and specialist security vendors.
Experience presenting security risk and program status to a board or executive governance committee.
Ability to run and improve a repeatable, measurable security program; work directly with security tooling and cloud consoles; exercise strategic judgment; communicate clearly to executives and external stakeholders; make sound risk and escalation decisions; and operate comfortably amid ambiguity.
Alignment with CredLens’ guiding values, commitment to equitable pathways to opportunity through PSET, and ability to contribute to a collaborative and healthy workplace culture.

Nice To Haves

An advanced degree.
Interest or experience in data-layer privacy technologies, including tokenization, hashing, field-level encryption, privacy-preserving record linkage, and related privacy-enhancing technologies.
Experience with state and federal assurance frameworks such as TX-RAMP, StateRAMP, GovRAMP, NIST 800-53, and NIST CSF.
Experience with application and product security tooling, including code scanning, secret detection, and dependency hardening, and with DevSecOps practices.
Background in EdTech, education, workforce development, or data-platform organizations, including higher education and state agency security reviews.
Experience in a startup, growth-stage, or nonprofit environment as a player-coach.
Experience establishing AI governance and acceptable-use controls.

Responsibilities

Run the information security management system, including continuous control monitoring, vulnerability management and remediation, quarterly access reviews, external-transfer approvals, vendor assessments, policy upkeep, and security and data-handling training.
Maintain SOC 2 Type II, ISO 27001, ISO 27018, and TX-RAMP certifications and reports, and manage auditor, penetration-test, internal-audit, and privacy-assessment relationships and the annual re-test calendar.
Serve as incident commander, maintain the incident response plan, conduct annual technical and executive tabletop and disaster-recovery/business-continuity exercises, meet notification commitments with Legal, and close corrective actions.
Oversee cloud security across AWS and Snowflake, including the PII enclave, account separation, identity and access controls, logging, and backup integrity.
Set a multi-year privacy-enhancing technology strategy across the platform and data-partner ecosystem, including tokenization, privacy-preserving record linkage, and encryption of sensitive fields.
Partner with the CTO on roadmap priorities, the VP, Legal and Data Protection on partner agreements and pilots, and the Technology and Security Advisory Board on method selection.
Advance data-minimization principles and extend independent assurance to privacy.
Own the Trust Center, HECVAT and questionnaire responses, and customer security reviews to support faster customer decisions.
Manage data-partner security relationships and third-party risk across data brokers, matching partners, and the IRS intermediary; review partner interfaces and transfer controls.
Lead a NIST 800-53 gap assessment and GovRAMP/StateRAMP readiness, and pursue certification when Sales validates demand.
Support Data Contributor and Use Agreement onboarding so security and privacy requirements are included in new agreements.
Prepare and present quarterly retrospective and forward-looking reports to the CredLens Board, and escalate confirmed breaches and high-severity incidents between meetings.
Staff the quarterly Cyber Governance Committee, covering risk appetite, policy exceptions, audit and test findings, incident retrospectives, and the annual risk assessment.
Engage the Technology and Security Advisory Board semi-annually on roadmap and tool choices.
Represent CredLens in Strada’s enterprise-wide NIST CSF assessment and December enterprise risk review, and maintain alignment with Strada GRC requirements.
Own AI governance, including responsible-use frameworks, security reviews of AI vendors, and controls for the managed enterprise AI workspace.
Lead and develop the DevSecOps Engineer, and plan security staffing, budget, and spend.
Manage specialist partners for audit, penetration testing and secure code review, internal audit and GRC, forensics, and cyber insurance, including the Mandiant retainer and insurer notice duties.
Run the security program for Digital Credentials Commons as a covered entity, beginning with vulnerability assessment and extending controls as appropriate.
Advise Strada Education Foundation on its SOC 2 Type II program, sharing CredLens practices and lessons learned.