Vice President, Information Security

Non-degree credentials are changing how people move from learning to earning, but growth has outpaced clarity. Outcomes data is scattered, which makes it nearly impossible to tell real impact from activity. CredLens exists to fix that.

Launched in 2024 with support from Strada Education Foundation, CredLens is a nonprofit national data trust. We connect issuer-verified credential records to real-world employment, earnings, and education outcomes. Partners use that evidence to improve programs, guide investment, and build stronger career pathways for learners.

Trust is the product. Every client relationship is governed by a Data Contributor and Use Agreement (DCUA), and its terms are enforced in software.  As a national data trust, we have to show, not just say, that every piece of processing follows those agreements and that we’re protecting the data entrusted to us.

Keep a certified program disciplined, measurable, and audit-ready. You will:

• →

  Run the information security management system day to day: continuous control monitoring, vulnerability management with remediation to target timeframes, quarterly access reviews, external-transfer approvals, vendor assessments, policy upkeep, and security and data-handling training.

• →

  Maintain SOC 2 Type II, ISO 27001, ISO 27018, and TX-RAMP without major findings, and manage auditor, penetration-test, internal-audit, and privacy-assessment relationships and the annual re-test calendar.

• →

  Serve as incident commander: own the incident response plan, run annual technical and executive tabletop and DR/BC exercises, meet notification commitments with Legal, and drive corrective actions to closure.

• →

  Oversee cloud security posture across AWS and Snowflake, including the PII enclave, account separation, identity and access controls, logging, and backup integrity.

Define how a national data trust protects sensitive data at the data layer itself. You will:

• Set the multi-year strategy for privacy-enhancing technologies (PETs) across the platform and data-partner ecosystem, including tokenization, privacy-preserving record linkage, and encryption of sensitive fields, in line with established industry standards.

• Partner with the CTO on roadmap prioritization and with the VP, Legal and Data Protection on the partner agreements and pilots that adoption depends on; engage the Technology and Security Advisory Board on method selection.

• Advance the data-minimization principles set by the Cyber Governance Committee: hold the least data, in the least exposed form, for the least time.

• Extend independent assurance to privacy, building on the Privacy Impact Assessment and SOC 2 program.

Turn a strong program into faster, more confident buying decisions. You will:

• Own the Trust Center, HECVAT and questionnaire responses, and customer security reviews so security speeds the sales cycle as the client base grows.

• Manage data-partner security relationships and third-party risk across data brokers, matching partners, and the IRS intermediary, and review partner interfaces and transfer controls.

• Lead a NIST 800-53 gap assessment and GovRAMP/StateRAMP readiness, and pursue certification when Sales validates demand.

• Support DCUA onboarding so security and privacy requirements are built into every new agreement.

Give leadership and the Board a clear view of risk and progress. You will:

• Prepare and present the quarterly retrospective and look-forward to the CredLens Board, and escalate confirmed breaches and high-severity incidents between meetings.

• Staff the quarterly Cyber Governance Committee: risk appetite, policy exceptions, audit and test findings, incident retrospectives, and the annual risk assessment.

• Engage the Technology and Security Advisory Board semi-annually on roadmap and tool choices.

• Represent CredLens in Strada's enterprise-wide NIST CSF assessment and December enterprise risk review, and keep alignment with Strada GRC requirements.

• Own AI governance: responsible-use frameworks, security review of AI vendors, and controls for the managed enterprise AI workspace.

Lead as a player-coach and extend the program's reach. You will:

• Lead and develop the DevSecOps Engineer, and plan staffing, budget, and spend across the security domain.

• Manage specialist partners for audit, penetration testing and secure code review, internal audit and GRC, forensics, and cyber insurance, including the Mandiant retainer and insurer notice duties.

• Run the security program for Digital Credentials Commons (DCC) as a covered entity, starting with vulnerability assessment and extending controls as appropriate.

• Advise Strada Education Foundation on its SOC 2 Type II program, sharing CredLens practices and lessons learned.

Example KPIs for 9–12 months; final targets set with the CTO in your first 90 days

• Bachelor's degree. We value demonstrated capability and learning agility over field of study.

• One or more of: CISSP, CCSP, CISM, CISA, CIPP, or CIPM.

• 10+ years in information security, including 5+ years leading a security program with budget, staffing, and audit accountability.

• A track record of operating and maturing a certified program, including maintaining SOC 2 Type II and ISO 27001 through multiple audit cycles.

• Hands-on security leadership in a cloud-native AWS environment, including account architecture, identity and access, logging, and continuous control monitoring tooling.

• Experience as incident commander, including tabletop exercises, severity-based response, breach notification, and retrospectives.

• Experience protecting highly sensitive personal data under contractual and regulatory constraints, such as FERPA, state breach-notification laws, and data-partner agreements.

• Customer-facing security experience: trust centers, security questionnaires, and due-diligence conversations with institutional buyers.

• Experience managing third-party risk and specialist security vendors.

• Experience presenting security risk and program status to a board or executive governance committee.

• An advanced degree.

• Interest or experience in data-layer privacy technologies: tokenization, hashing, field-level encryption, privacy-preserving record linkage, and related PETs.

• Experience with state and federal assurance frameworks such as TX-RAMP, StateRAMP, GovRAMP, NIST 800-53, and NIST CSF.

• Experience with application and product security tooling (code scanning, secret detection, dependency hardening) and DevSecOps practices.

• Background in EdTech, education, workforce development, or data-platform organizations, including higher education and state agency security reviews.

• Experience in a startup, growth-stage, or nonprofit environment as a player-coach.

• Experience establishing AI governance and acceptable-use controls.

• Operator mindset: You run a repeatable program with discipline, measure it, and improve it without reinventing it.

• Technical depth: You're comfortable working directly in security tooling and cloud consoles alongside a small engineering team.

• Strategic judgment: You can shape and sequence a multi-year privacy technology roadmap that depends on partners and agreements.

• Clear communication: You produce concise, board-ready materials and translate technical risk for executives, clients, auditors, and partners.

• Commercial awareness: You treat security assurance as a growth enabler and match investment to validated market demand.

• Sound judgment: You make good calls on risk acceptance, escalation, and disruptive containment decisions.

• Comfort with ambiguity: You thrive at the pace of an organization in a high-growth phase.

CredLens is a nonprofit national data trust built to answer one of the biggest open questions in education and workforce development: which non-degree credentials actually lead to better jobs, earnings, and further education? By connecting issuer-verified credential records to real-world outcomes, we give issuers, state agencies, higher education, and investors evidence they can trust, so learners can make better choices and programs can get better.

We were launched with support from Strada Education Foundation, a national nonprofit focused on strengthening the connections between education and employment, especially for people who have faced the greatest barriers to economic opportunity. At CredLens, you'll have the focus and pace of a growth-stage organization, backed by a mission-driven parent. You'll own a mature, certified program at a pivotal moment, work closely with senior leadership and the Board, and help set the standard for how outcomes data is protected nationwide.