[Hiring] Security and Data Protection Lead @JerseySTEM, Inc.

Role Description

The Security and Data Protection Lead is a high-impact role designed for an experienced professional who can bridge the gap between strategic direction and technical execution. You will be responsible for safeguarding JerseySTEM’s digital assets and ensuring the privacy of our community's data. This role blends hands-on implementation with tactical oversight, focusing on building practical framework programs and policies for our security posture while maintaining the agility required for a non-profit environment.

Qualifications

• 8+ years of proven experience in cybersecurity, information security, or data privacy roles.
• Ability to work independently as a “doer”, taking ownership of tasks from conception to completion.
• Strong understanding of technical security controls (IAM, encryption, network security) and governance frameworks (e.g., NIST CSF, NIST 800-53, ISO 27001).
• Partner with the JerseySTEM TECH and non-technical team to prioritize and incorporate security perspectives into tools and workflows.
• Draft, socialize, and maintain right-sized security policies, standards, and procedures appropriate for a nonprofit organization.
• Stay current on evolving threats (including AI-enabled threats) and share relevant, actionable recommendations with leadership and technical teams.
• Excellent communication skills to advise leadership on security architecture and risk.
• Comfortable working in a fully remote, member-driven organization.
• Relevant certifications are a plus but not required (e.g., CISSP, CISM, Security+, CCSP, GIAC).
• Exposure to AI/ML security considerations helpful, not required.

Requirements

• Implement and manage robust authentication services and access controls to ensure only authorized contributors have access to sensitive systems.
• Conduct regular vulnerability assessments and manage the remediation of technical security gaps across the organization's platforms.
• Serve as the primary responder for security incidents, developing and maintaining the organizational incident response plan to minimize impact.
• Oversee the technical focus of cloud-based security configurations, ensuring tools like Google Workspace and other internal systems are hardened against threats.
• Develop and enforce policies specifically tailored to data protection, ensuring compliance with relevant privacy standards and best practices.
• Translate high-level strategic direction into actionable policies and procedural documentation that can be easily followed by non-technical volunteers.
• Drive security awareness training for all JerseySTEM members, fostering a culture of "Security First" across the organization.
• Establish monitoring and auditing processes to protect against internal data leakage and unauthorized data sharing.

Benefits

• Membership is a minimum six-month commitment of approximately 6-8 flexible hours per week.
• Includes a $100 refundable deposit, returned after six months of active membership.
• K–12 educators, retirees, veterans, interns, and students are exempt from the deposit.