Steven Hernandez became the U.S. Department of Education’s chief information security officer in December 2017. CyberScoop reported the hire on December 7, with a December 10 start date. Hernandez came from the Department of Health and Human Services Office of Inspector General (HHS OIG), where he had served as CISO since 2010. The appointment put an experienced federal oversight-agency security chief in charge of department-wide information-security responsibilities during heightened scrutiny of the FAFSA system.
What happened
CyberScoop reporter Greg Otto reported on December 7, 2017, that the Department of Education had hired Hernandez as its new CISO. His first day was scheduled for December 10. The report described a change in the department’s information-technology leadership, not the creation of a newly established office.
As an Amazon Associate I earn from qualifying purchases.
Hernandez was expected to assist Education CIO Jason Gray. Gray described him as a cybersecurity leader whose experience would strengthen the department’s leadership team. CyberScoop’s report is the contemporaneous source for the appointment, start date and leadership statements.
Recommended Free Tools
| Milestone | What the available record shows |
|---|---|
| December 7, 2017 | CyberScoop reported Hernandez’s selection as Education CISO. |
| December 10, 2017 | Scheduled first day at the Department of Education. |
| Before Education | HHS OIG CISO since 2010. |
| 2018–2020 | Education and NCES materials continued to identify him as CISO and showed him presenting on education-sector cybersecurity. |
| FY2024 audit material | A Department of Education OIG document listed Steven Hernandez as chief information security officer in the Office of the CIO. |
Who Steven Hernandez was
Hernandez arrived after a long federal cybersecurity career at HHS OIG. In that role, he worked in an inspector-general environment where protecting sensitive government information, meeting federal requirements and managing institutional risk are central responsibilities.
#1 Best Overall
Later Education-hosted material supplies additional biographical detail that was not part of the original 2017 news report. A presentation identifies Hernandez with an MBA and the credentials CISSP, CISA, CNSS, CSSLP, SSCP, CAP and ITIL. It also identifies him as a former vice chairman of the (ISC)² board of directors. Those details appear in the later presentation, available as a Department of Education-hosted PDF, rather than in CyberScoop’s appointment story.
What the Education CISO role covered
CyberScoop attributed the position’s scope to a June job listing. The description was considerably broader than securing one website or application:
- Information integrity and privacy: maintaining the confidentiality, integrity and privacy of Education information.
- Enterprise coordination: integrating cyber, telecommunications and information-security programs across the department.
- Risk and vulnerability management: identifying weaknesses, reducing exposure and improving the department’s overall security posture.
- Compliance: ensuring that security practices met federal statutes, regulations and executive directives.
- Operations: managing enterprise-wide security activities and risk processes.
- Resources: preparing budget justifications and connecting security priorities with funding decisions.
In practical terms, the role required balancing privacy, availability, resilience, compliance and limited federal resources. It covered department-wide systems and information, so it should not be reduced to responsibility for FAFSA alone.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
Why the appointment drew attention in 2017
The hire came during a difficult period for the Department of Education’s Free Application for Federal Student Aid (FAFSA) system. FAFSA had been taken offline for several months and returned on October 1, 2017. In November, cybersecurity blogger Brian Krebs reported that the system could potentially be manipulated to expose substantial personally identifiable information. The Department of Education disputed that report, according to CyberScoop.
The timing made the CISO appointment especially significant: a major public-facing education service was under security scrutiny while the department was bringing in new security leadership. The available reporting does not establish that the FAFSA allegations caused Hernandez’s hiring, that he was hired specifically to repair FAFSA, or that the department accepted the vulnerability claim.
FAFSA is associated with Federal Student Aid, while the CISO job described by CyberScoop covered the Department of Education’s broader information-security enterprise. That distinction matters when interpreting the appointment.
What Hernandez worked on after joining Education
Subsequent official Education and National Center for Education Statistics materials show Hernandez publicly addressing cybersecurity issues affecting schools, state agencies and education-data systems.
2018: threats facing education agencies
The National Forum on Education Statistics’ Summer 2018 meeting materials identify Hernandez as Education CISO and describe a presentation on cybersecurity in state and local education agencies. Topics included ransomware, business-email compromise, backups, vulnerability assessments, incident planning, law-enforcement coordination and protection of education data. The material also addressed third-party applications and privacy implications connected with the Family Educational Rights and Privacy Act (FERPA).
2019: authentication, phishing and student data
The Summer 2019 National Forum materials again identify Hernandez as CISO. They emphasize multifactor authentication, phishing defenses, vendor security and protection of students’ personally identifiable information.
2020: remote learning and remote work
An Education Statewide Longitudinal Data Systems webinar listing identifies Hernandez as a speaker on cybersecurity for remote learning and remote working, reflecting the rapid shift of education services and staff operations online.
These later appearances do not prove that Hernandez personally directed every security program discussed. They do show the subjects Education’s CISO was communicating about as education systems faced ransomware, phishing, third-party risk and expanded remote access.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →How long did he remain CISO?
Official materials continue to identify Hernandez as Education CISO in 2018, 2019 and 2020. A Department of Education OIG audit document for fiscal year 2024 also lists Steven Hernandez as chief information security officer in the Office of the CIO: FY2024 information-technology audit material.
Best Value
That record supports describing him as remaining associated with the role for several years. It does not establish his employment status on August 18, 2026, because the available evidence does not provide a newer confirmation or a complete employment timeline.
Why the appointment matters historically
Hernandez’s move from HHS OIG to Education illustrates the breadth of a federal CISO’s job. The assignment combined protection of sensitive student and applicant information with enterprise risk management, telecommunications coordination, statutory compliance, vulnerability reduction and budget planning. It also placed security leadership in an agency whose services depend on large-scale data exchanges among students, families, schools, states, contractors and federal programs.
The 2017 appointment therefore matters less as a claim about one FAFSA incident than as a snapshot of federal education security at a moment when public-facing systems, privacy obligations and growing cyber threats were converging.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
