{"id":3119306,"url":"https://alion.io/job/strada-vice-president-information-security","title":"Vice President, Information Security","company":{"id":37884,"name":"Strada","domain":"strada.org","url":"https://alion.io/company/strada-org","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":null},"role":"Security","role_family":"Security","seniority":"head","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Washington, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":201300,"max":222850,"currency":"USD","period":"year","gross":null,"usd_annual":222850},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"ISO 27001","optional":false},{"name":"NIST 800-53","optional":false},{"name":"NIST CSF","optional":false},{"name":"Snowflake","optional":false},{"name":"SOC 2","optional":false},{"name":"Tokenization","optional":false}],"status":"live","first_seen_at":"2026-10-22T22:09:10Z","employer_posted_date":"2026-10-22","last_verified_at":"2026-10-28T11:39:12Z","board_verified":true,"closed_at":null,"days_open":5,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":5},"description":"Full-time | Washington D.C. | Reports to the Chief Technology Officer | Travel: 10%\nProtect the data that proves what works for learners\nNon-degree credentials are changing how people move from learning to earning, but growth has outpaced clarity. Outcomes data is scattered, which makes it nearly impossible to tell real impact from activity. CredLens exists to fix that.\nLaunched in 2024 with support from Strada Education Foundation, CredLens is a nonprofit national data trust. We connect issuer-verified credential records to real-world employment, earnings, and education outcomes. Partners use that evidence to improve programs, guide investment, and build stronger career pathways for learners.\nTrust is the product. Every client relationship is governed by a Data Contributor and Use Agreement (DCUA), and its terms are enforced in software. As a national data trust, we have to show, not just say, that every piece of processing follows those agreements and that we’re protecting the data entrusted to us.\nYou won't be starting from scratch. The program is already mature: two full SOC 2 Type II reports, ISO 27001 and ISO 27018 certification since 2025, TX-RAMP Level 2 certification, and a recent independent Privacy Impact Assessment that highlighted the program's maturity.\nThis is an operator and scaler role. Reporting to the CTO and supported by the VP, Legal and Data Protection who’s also our Chief Privacy Officer, you'll run the day-to-day program and lead a small core team extended by specialist firms and an independent Technology and Security Advisory Board. You'll directly support the Cyber Governance Committee and the CredLens Board. CredLens is moving from early traction to broad adoption across issuers, state agencies, and higher education. Your job is to make security speed up customer due diligence, not slow it down.\nIf you want to run a high-integrity security program, shape privacy-enhancing technology strategy at national scale, and do it in service of a mission that matters, we'd like to talk.\nWhat You'll Do\nApproximate time allocation for the first 12-18 months\nRun Security Operations, Compliance, and Controls Assurance (~30%)\nKeep a certified program disciplined, measurable, and audit-ready. You will:\nRun the information security management system day to day: continuous control monitoring, vulnerability management with remediation to target timeframes, quarterly access reviews, external-transfer approvals, vendor assessments, policy upkeep, and security and data-handling training.\n\nMaintain SOC 2 Type II, ISO 27001, ISO 27018, and TX-RAMP without major findings, and manage auditor, penetration-test, internal-audit, and privacy-assessment relationships and the annual re-test calendar.\n\nServe as incident commander: own the incident response plan, run annual technical and executive tabletop and DR/BC exercises, meet notification commitments with Legal, and drive corrective actions to closure.\n\nOversee cloud security posture across AWS and Snowflake, including the PII enclave, account separation, identity and access controls, logging, and backup integrity.\n\nLead Privacy-Enhancing Technologies and Data-Layer Privacy Strategy (~25%)\nDefine how a national data trust protects sensitive data at the data layer itself. You will:\nSet the multi-year strategy for privacy-enhancing technologies (PETs) across the platform and data-partner ecosystem, including tokenization, privacy-preserving record linkage, and encryption of sensitive fields, in line with established industry standards.\n\nPartner with the CTO on roadmap prioritization and with the VP, Legal and Data Protection on the partner agreements and pilots that adoption depends on; engage the Technology and Security Advisory Board on method selection.\n\nAdvance the data-minimization principles set by the Cyber Governance Committee: hold the least data, in the least exposed form, for the least time.\n\nExtend independent assurance to privacy, building on the Privacy Impact Assessment and SOC 2 program.\n\nMake Security a Growth Engine for Customers, Partners, and the Market (~15%)\nTurn a strong program into faster, more confident buying decisions. You will:\nOwn the Trust Center, HECVAT and questionnaire responses, and customer security reviews so security speeds the sales cycle as the client base grows.\n\nManage data-partner security relationships and third-party risk across data brokers, matching partners, and the IRS intermediary, and review partner interfaces and transfer controls.\n\nLead a NIST 800-53 gap assessment and GovRAMP/StateRAMP readiness, and pursue certification when Sales validates demand.\n\nSupport DCUA onboarding so security and privacy requirements are built into every new agreement.\n\nDrive Governance, Risk, and Board Reporting (~15%)\nGive leadership and the Board a clear view of risk and progress. You will:\nPrepare and present the quarterly retrospective and look-forward to the CredLens Board, and escalate confirmed breaches and high-severity incidents between meetings.\n\nStaff the quarterly Cyber Governance Committee: risk appetite, policy exceptions, audit and test findings, incident retrospectives, and the annual risk assessment.\n\nEngage the Technology and Security Advisory Board semi-annually on roadmap and tool choices.\n\nRepresent CredLens in Strada's enterprise-wide NIST CSF assessment and December enterprise risk review, and keep alignment with Strada GRC requirements.\n\nOwn AI governance: responsible-use frameworks, security review of AI vendors, and controls for the managed enterprise AI workspace.\n\nBuild the Team, Partners, and Affiliated Programs (~15%)\nLead as a player-coach and extend the program's reach. You will:\nLead and develop the DevSecOps Engineer, and plan staffing, budget, and spend across the security domain.\n\nManage specialist partners for audit, penetration testing and secure code review, internal audit and GRC, forensics, and cyber insurance, including the Mandiant retainer and insurer notice duties.\n\nRun the security program for Digital Credentials Commons (DCC) as a covered entity, starting with vulnerability assessment and extending controls as appropriate.\n\nAdvise Strada Education Foundation on its SOC 2 Type II program, sharing CredLens practices and lessons learned.\n\nWhat Success Looks Like in Your First Year\nExample KPIs for 9-12 months; final targets set with the CTO in your first 90 days\nCompliance maintained: All certifications and audit reports renewed with no major findings.\n\nSecurity roadmap delivered: The agreed annual hardening and re-test plan completed on schedule, with findings remediated within target timeframes.\n\nPrivacy strategy underway: A PETs roadmap approved by the Cyber Governance Committee, with the first partner pilot defined and underway.\n\nCustomer assurance at scale: Security reviews turned around within an agreed SLA as client volume grows; readiness for additional state and federal frameworks assessed, with a recommendation.\n\nGovernance cadence sustained: Quarterly Board and Cyber Governance Committee reporting delivered, corrective actions tracked to closure, and the annual risk assessment completed.\n\nTeam and partners effective: Security staff, specialist firms, and advisory relationships operating with clear scope, budget discipline, and measurable outcomes.\n\nWhat You Bring\nRequired:\nBachelor's degree. We value demonstrated capability and learning agility over field of study.\n\nOne or more of: CISSP, CCSP, CISM, CISA, CIPP, or CIPM.\n\n10+ years in information security, including 5+ years leading a security program with budget, staffing, and audit accountability.\n\nA track record of operating and maturing a certified program, including maintaining SOC 2 Type II and ISO 27001 through multiple audit cycles.\n\nHands-on security leadership in a cloud-native AWS environment, including account architecture, identity and access, logging, and continuous control monitoring tooling.\n\nExperience as incident commander, including tabletop exercises, severity-based response, breach notification, and retrospectives.\n\nExperience protecting highly sensitive personal data under contractual and regulatory constraints, such as FERPA, state breach-notification laws, and data-partner agreements.\n\nCustomer-facing security experience: trust centers, security questionnaires, and due-diligence conversations with institutional buyers.\n\nExperience managing third-party risk and specialist security vendors.\n\nExperience presenting security risk and program status to a board or executive governance committee.\n\nNice to have:\nAn advanced degree.\n\nInterest or experience in data-layer privacy technologies: tokenization, hashing, field-level encryption, privacy-preserving record linkage, and related PETs.\n\nExperience with state and federal assurance frameworks such as TX-RAMP, StateRAMP, GovRAMP, NIST 800-53, and NIST CSF.\n\nExperience with application and product security tooling (code scanning, secret detection, dependency hardening) and DevSecOps practices.\n\nBackground in EdTech, education, workforce development, or data-platform organizations, including higher education and state agency security reviews.\n\nExperience in a startup, growth-stage, or nonprofit environment as a player-coach.\n\nExperience establishing AI governance and acceptable-use controls.\n\nAlso important - how you work:\nOperator mindset: You run a repeatable program with discipline, measure it, and improve it without reinventing it.\n\nTechnical depth: You're comfortable working directly in security tooling and cloud consoles alongside a small engineering team.\n\nStrategic judgment: You can shape and sequence a multi-year privacy technology roadmap that depends on partners and agreements.\n\nClear communication: You produce concise, board-ready materials and translate technical risk for executives, clients, auditors, and partners.\n\nCommercial awareness: You treat security assurance as a growth enabler and match investment to validated market demand.\n\nSound judgment: You make good calls on risk acceptance, escalation, and disruptive containment decisions.\n\nComfort with ambiguity: You thrive at the pace of an organization in a high-growth phase.\n\nWhy CredLens\nCredLens is a nonprofit national data trust built to answer one of the biggest open questions in education and workforce development: which non-degree credentials actually lead to better jobs, earnings, and further education? By connecting issuer-verified credential records to real-world outcomes, we give issuers, state agencies, higher education, and investors evidence they can trust, so learners can make better choices and programs can get better.\nWe were launched with support from Strada Education Foundation, a national nonprofit focused on strengthening the connections between education and employment, especially for people who have faced the greatest barriers to economic opportunity. At CredLens, you'll have the focus and pace of a growth-stage organization, backed by a mission-driven parent. You'll own a mature, certified program at a pivotal moment, work closely with senior leadership and the Board, and help set the standard for how outcomes data is protected nationwide.\nBenefits\nMedical, dental, and vision insurance\n\nGenerous PTO and paid holidays\n\n401(k) retirement plan with employer contributions\n\nPaid parental leave\n\nWellness reimbursement\n\nProfessional development resources","description_format":"text","description_chars":11398,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Parental leave","Professional development","Retirement plans","Vision insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["E-learning","Nonprofits & Foundations"],"lifecycle":[{"event":"open","at":"2026-10-22T23:43:44Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":5,"expected_fill_days":30,"reasons":["conf:3","win:early"],"computed_at":"2026-10-28T05:59:10Z"},"pay":{"stated_usd_annual":222850,"is_top_pay":true},"html_url":"https://alion.io/job/strada-vice-president-information-security","json_url":"https://alion.io/job/strada-vice-president-information-security.json","meta":{"generated_at":"2026-10-28T13:11:35Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":17730,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-29T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":37884},"rest":"https://alion.io/mcp/rest/get_company?id=37884"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fstrada-vice-president-information-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fstrada-vice-president-information-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fstrada-vice-president-information-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/strada-vice-president-information-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fstrada-vice-president-information-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3119306}},{"tool":"search_jobs","arguments":{"company":"strada.org","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3119306},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}