Best practices to use chef-vault

Greetings Masters

I have created a powershell loop to execute following command
knife winrm NODENAME "chef-client -c c:/chef/client.rb" -m -x USERNAME -P "SUPER_SECRET_PASSWORD"

I want to pass above mentioned USERNAME and SUPER_SECRET_PASSWORD from vault. What is the best practice to do that?

Thanks
MM