Vice President, Information Security

Job Description

Job Description:\n\n Full-time | Washington D.C. | Reports to the Chief Technology Officer | Travel: 10%Protect the data that proves what works for learners\n Non-degree credentials are changing how people move from learning to earning, but growth has outpaced clarity. Outcomes data is scattered, which makes it nearly impossible to tell real impact from activity. CredLens exists to fix that.\n Launched in 2024 with support from Strada Education Foundation, CredLens is a nonprofit national data trust. We connect issuer-verified credential records to real-world employment, earnings, and education outcomes. Partners use that evidence to improve programs, guide investment, and build stronger career pathways for learners.\n Trust is the product. Every client relationship is governed by a Data Contributor and Use Agreement (DCUA), and its terms are enforced in software. As a national data trust, we have to show, not just say, that every piece of processing follows those agreements and that we’re protecting the data entrusted to us.\n You won't be starting from scratch. The program is already mature: two full SOC 2 Type II reports, ISO 27001 and ISO 27018 certification since 2025, TX-RAMP Level 2 certification, and a recent independent Privacy Impact Assessment that highlighted the program's maturity.\n This is an operator and scaler role. Reporting to the CTO and supported by the VP, Legal and Data Protection who’s also our Chief Privacy Officer, you'll run the day-to-day program and lead a small core team extended by specialist firms and an independent Technology and Security Advisory Board. You'll directly support the Cyber Governance Committee and the CredLens Board. CredLens is moving from early traction to broad adoption across issuers, state agencies, and higher education. Your job is to make security speed up customer due diligence, not slow it down.\n If you want to run a high-integrity security program, shape privacy-enhancing technology strategy at national scale, and do it in service of a mission that matters, we'd like to talk.What You'll Do\n Approximate time allocation for the first 12–18 months\n Run Security Operations, Compliance, and Controls Assurance (~30%)\n Keep a certified program disciplined, measurable, and audit-ready. You will:\n \n \n Run the information security management system day to day: continuous control monitoring, vulnerability management with remediation to target timeframes, quarterly access reviews, external-transfer approvals, vendor assessments, policy upkeep, and security and data-handling training.\n \n Maintain SOC 2 Type II, ISO 27001, ISO 27018, and TX-RAMP without major findings, and manage auditor, penetration-test, internal-audit, and privacy-assessment relationships and the annual re-test calendar.\n \n Serve as incident commander: own the incident response plan, run annual technical and executive tabletop and DR/BC exercises, meet notification commitments with Legal, and drive corrective actions to closure.\n \n Oversee cloud security posture across AWS and Snowflake, including the PII enclave, account separation, identity and access controls, logging, and backup integrity.\n \n Lead Privacy-Enhancing Technologies and Data-Layer Privacy Strategy (~25%)\n Define how a national data trust protects sensitive data at the data layer itself. You will:\n \n \n Set the multi-year strategy for privacy-enhancing technologies (PETs) across the platform and data-partner ecosystem, including tokenization, privacy-preserving record linkage, and encryption of sensitive fields, in line with established industry standards.\n \n Partner with the CTO on roadmap prioritization and with the VP, Legal and Data Protection on the partner agreements and pilots that adoption depends on; engage the Technology and Security Advisory Board on method selection.\n \n Advance the data-minimization principles set by the Cyber Governance Committee: hold the least data, in the least exposed form, for the least time.\n \n Extend independent assurance to privacy, building on the Privacy Impact Assessment and SOC 2 program.\n \n Make Security a Growth Engine for Customers, Partners, and the Market (~15%)\n Turn a strong program into faster, more confident buying decisions. You will:\n \n \n Own the Trust Center, HECVAT and questionnaire responses, and customer security reviews so security speeds the sales cycle as the client base grows.\n \n Manage data-partner security relationships and third-party risk across data brokers, matching partners, and the IRS intermediary, and review partner interfaces and transfer controls.\n \n Lead a NIST 800-53 gap assessment and GovRAMP/StateRAMP readiness, and pursue certification when Sales validates demand.\n \n Support DCUA onboarding so security and privacy requirements are built into every new agreement.\n \n Drive Governance, Risk, and Board Reporting (~15%)\n Give leadership and the Board a clear view of risk and progress. You will:\n \n \n Prepare and present the quarterly retrospective and look-forward to the CredLens Board, and escalate confirmed breaches and high-severity incidents between meetings.\n \n Staff the quarterly Cyber Governance Committee: risk appetite, policy exceptions, audit and test findings, incident retrospectives, and the annual risk assessment.\n \n Engage the Technology and Security Advisory Board semi-annually on roadmap and tool choices.\n \n Represent CredLens in Strada's enterprise-wide NIST CSF assessment and December enterprise risk review, and keep alignment with Strada GRC requirements.\n \n Own AI governance: responsible-use frameworks, security review of AI vendors, and controls for the managed enterprise AI workspace.\n \n Build the Team, Partners, and Affiliated Programs (~15%)\n Lead as a player-coach and extend the program's reach. You will:\n \n \n Lead and develop the DevSecOps Engineer, and plan staffing, budget, and spend across the security domain.\n \n Manage specialist partners for audit, penetration testing and secure code review, internal audit and GRC, forensics, and cyber insurance, including the Mandiant retainer and insurer notice duties.\n \n Run the security program for Digital Credentials Commons (DCC) as a covered entity, starting with vulnerability assessment and extending controls as appropriate.\n \n Advise Strada Education Foundation on its SOC 2 Type II program, sharing CredLens practices and lessons learned.\n What Success Looks Like in Your First Year\n Example KPIs for 9–12 months; final targets set with the CTO in your first 90 days\n \n \n Compliance maintained: All certifications and audit reports renewed with no major findings.\n \n Security roadmap delivered: The agreed annual hardening and re-test plan completed on schedule, with findings remediated within target timeframes.\n \n Privacy strategy underway: A PETs roadmap approved by the Cyber Governance Committee, with the first partner pilot defined and underway.\n \n Customer assurance at scale: Security reviews turned around within an agreed SLA as client volume grows; readiness for additional state and federal frameworks assessed, with a recommendation.\n \n Governance cadence sustained: Quarterly Board and Cyber Governance Committee reporting delivered, corrective actions tracked to closure, and the annual risk assessment completed.\n \n Team and partners effective: Security staff, specialist firms, and advisory relationships operating with clear scope, budget discipline, and measurable outcomes.\n What You Bring\n Required:\n \n \n Bachelor's degree. We value demonstrated capability and learning agility over field of study.\n \n One or more of: CISSP, CCSP, CISM, CISA, CIPP, or CIPM.\n \n 10+ years in information security, including 5+ years leading a security program with budget, staffing, and audit accountability.\n \n A track record of operating and maturing a certified program, including maintaining SOC 2 Type II and ISO 27001 through multiple audit cycles.\n \n Hands-on security leadership in a cloud-native AWS environment, including account architecture, identity and access, logging, and continuous control monitoring tooling.\n \n Experience as incident commander, including tabletop exercises, severity-based response, breach notification, and retrospectives.\n \n Experience protecting highly sensitive personal data under contractual and regulatory constraints, such as FERPA, state breach-notification laws, and data-partner agreements.\n \n Customer-facing security experience: trust centers, security questionnaires, and due-diligence conversations with institutional buyers.\n \n Experience managing third-party risk and specialist security vendors.\n \n Experience presenting security risk and program status to a board or executive governance committee.\n \n Nice to have:\n \n \n An advanced degree.\n \n Interest or experience in data-layer privacy technologies: tokenization, hashing, field-level encryption, privacy-preserving record linkage, and related PETs.\n \n Experience with state and federal assurance frameworks such as TX-RAMP, StateRAMP, GovRAMP, NIST 800-53, and NIST CSF.\n \n Experience with application and product security tooling (code scanning, secret detection, dependency hardening) and DevSecOps practices.\n \n Background in EdTech, education, workforce development, or data-platform organizations, including higher education and state agency security reviews.\n \n Experience in a startup, growth-stage, or nonprofit environment as a player-coach.\n \n Experience establishing AI governance and acceptable-use controls.\n \n Also important — how you work:\n \n \n Operator mindset: You run a repeatable program with discipline, measure it, and improve it without reinventing it.\n \n Technical depth: You're comfortable working directly in security tooling and cloud consoles alongside a small engineering team.\n \n Strategic judgment: You can shape and sequence a multi-year privacy technology roadmap that depends on partners and agreements.\n \n Clear communication: You produce concise, board-ready materials and translate technical risk for executives, clients, auditors, and partners.\n \n Commercial awareness: You treat security assurance as a growth enabler and match investment to validated market demand.\n \n Sound judgment: You make good calls on risk acceptance, escalation, and disruptive containment decisions.\n \n Comfort with ambiguity: You thrive at the pace of an organization in a high-growth phase.\n Why CredLens\n CredLens is a nonprofit national data trust built to answer one of the biggest open questions in education and workforce development: which non-degree credentials actually lead to better jobs, earnings, and further education? By connecting issuer-verified credential records to real-world outcomes, we give issuers, state agencies, higher education, and investors evidence they can trust, so learners can make better choices and programs can get better.\n We were launched with support from Strada Education Foundation, a national nonprofit focused on strengthening the connections between education and employment, especially for people who have faced the greatest barriers to economic opportunity. At CredLens, you'll have the focus and pace of a growth-stage organization, backed by a mission-driven parent. You'll own a mature, certified program at a pivotal moment, work closely with senior leadership and the Board, and help set the standard for how outcomes data is protected nationwide.Benefits\n \n \n Medical, dental, and vision insurance\n \n Generous PTO and paid holidays\n \n 401(k) retirement plan with employer contributions\n \n Paid parental leave\n \n Wellness reimbursement\n \n Professional development resources\n \n\n plus bonus\n The pay range listed is based on national compensation benchmark data and may vary depending on skills, experience, job-related knowledge, variations in cost of labor, and, in some cases, geographic location. The exact job offer will be determined based on several factors, such as the candidate's individual skills, qualifications and experience relative to the requirements of the role. The range displayed with the job posting represents the minimum and maximum target for new hire salaries for the position across the U.S.\n The company also reviews and considers internal equity (current employee salary) when hiring new employees to the organization. The range is the expected starting base salary for someone hired into this position with room to grow professionally, including increased earning potential beyond the starting pay range. Beyond a new hire's base salary, CredLens also offers all full-time employees a comprehensive employee benefit package.\n\n By submitting this application, I certify that the information provided is accurate and complete to the best of my knowledge. I understand that any false statement, misrepresentation, or omission may disqualify me from consideration or result in termination if discovered after employment begins. Candidates who receive an offer of employment will be required to provide professional references and successfully complete a background check and education verification as a condition of employment.\n\n \n\n Mission and Values Alignment:\n\n Committed to providing equitable pathways to opportunity through PSET, particularly for individuals who have faced significant barriers. Demonstrated alignment with CredLens' guiding values, commitment to building a strong and healthy workplace culture, and working in a collaborative environment. \n\n \n\n Diversity, equity, and inclusion are central to CredLens' organizational vibrancy, employee experience, and mission. We strongly encourage applicants from people of color/the global majority, immigrant, bilingual, and bicultural individuals; people with disabilities, members of the LGBTQIA2S+ and gender nonconforming communities; and people with other diverse backgrounds and lived experiences. We believe every member on the team enriches our workplace by exposing us to a broad range of ways to understand and engage with the world, identify challenges, and discover, design, and deliver critical insights and solutions.