Principal, Information System Security Officer & Security Operations Lead

Ingram Micro Inc; Irvine (CA); On-site; USD 133,000 - 227,000; Full time

Benefits offered by this job

Healthcare benefits

Paid time off

Parental leave

401(k) with company match

Job summary

Ingram Micro Inc. is seeking an ISSO & Security Operations Lead to own the security posture of the CUI enclave, author SSP/POA&M, lead NIST 800-171A assessments, sustain SPRS, and guide C3PAO certification while operating SIEM during business hours.

You will triage alerts, threat hunt, execute incident response runbooks, and manage 72-hour DIBNet reporting, with on-call rotations and travel for audits. This is a full-time exempt role based in the U.S.

Qualifications

• Hands-on SIEM experience with BigQuery/Looker or comparable
• Detection engineering and incident-response/threat-hunting execution required
• Experience in GRC, policy writing, and security controls
• Knowledge of NIST SP 800-171A, 800-171 Rev.2, and CMMC 2.0 Level 2
• Ability to support on-call rotation for critical incidents outside business hours

Responsibilities

• Own the SSP, POA&M, and supporting security policies for the enclave boundary
• Lead assessments against NIST SP 800-171A including sampling and evidence collection
• Calculate and maintain the SPRS score and annual affirmation package
• Govern Google Workspace security configuration and related controls
• Manage C3PAO certification engagement and pre-audit activities
• Run the annual self-assessment and continuous-monitoring program
• Triage alerts, investigate events, threat-hunt, and coordinate incident response

Skills

SIEM experience

Threat hunting

Incident response

Detection engineering

Security policy writing

Education

Bachelor's degree in cyber security / CS / engineering

Tools

BigQuery

Looker

Workspace audit logs

WorkSpaces

Job description

Accelerate your career. Join the organization that's driving the world's technology and shape the future.

Ingram Micro is a leading technology company for the global information technology ecosystem. With the ability to reach nearly 90% of the global population, we play a vital role in the worldwide IT sales channel, bringing products and services from technology manufacturers and cloud providers to business-to-business technology experts. Our market reach, diverse solutions and services portfolio, and digital platform Ingram Micro Xvantage™ set us apart. Learn more at www.ingrammicro.com

Come join our team where you'll make technology happen in surprising ways. Let's shape tomorrow - it'll be a fun journey!

Your role:

The ISSO & Security Operations Lead owns the security and compliance posture of the CUI enclave end-to-end - authoring and maintaining the State System Security Plan (SSP) and Plan of Action and Milestones (POA&M), leading control assessments against NIST SP 800-171A, sustaining the SPRS score, and shepherding the organization through Certified Third Party Assessor Organization (C3PAO) certification - while also personally operating the SIEM over enclave telemetry during business hours, triaging alerts, threat hunting, executing incident-response runbooks, and owning DIBNet 72-hour regulatory reporting.

Governance and Compliance:

• Author, own, and continuously maintain the SSP, POA&M, and supporting security policies for the enclave boundary.
• Lead assessments of all 110 practices / 320 objectives against NIST SP 800-171A (Test of Design and Operating Effectiveness), including sampling, evidence collection, and gap remediation.
• Calculate and maintain the SPRS score; prepare the senior-official annual affirmation package.
• Govern Google Workspace security configuration - DLP, Vault, Drive labels/IRM, Context-Aware Access, and unified audit logs.
• Manage the C3PAO certification engagement and the KPMG independent design review, build review, and pre-audit (mock C3PAO).
• Maintain the CUI program: marking, handling, decontrol, retention, and DFARS 252.204-7012 flow-down interpretation with the BU.
• Run the annual self-assessment and continuous-monitoring program; track POA&M closure to schedule.

Security Monitoring and Incident Response:

• Perform business-hours monitoring and detection using the SIEM / BigQuery log store over enclave telemetry; serve as the named on-call escalation point for after-hours Sev1/2 alerts.
• Triage alerts, investigate events, and conduct proactive threat hunting.
• Execute incident response per runbooks SOP-LOG-004 (audit log review) and SOP-INC-008 (incident handling).
• Own DIBNet 72-hour incident reporting and coordinate all regulatory notifications.
• Integrate and tune enclave telemetry sources (Workspace audit logs, WorkSpaces, identity, endpoint).
• Maintain detection content, on-call handover documentation, and post-incident lessons-learned records.
• Contribute monitoring evidence for control assessments and continuous monitoring.

What you bring to the role:

Education

Bachelor's degree or higher in cyber security, computer science/engineering, management of information systems or similar degrees.

Experience

• 7+ years in information security / GRC, with demonstrable CUI or regulated-environment experience.
• Deep, current expertise in NIST SP 800-171 Rev. 2 / 800-171A and CMMC 2.0 Level 2.
• Hands-on SSP and POA&M authoring and control-assessment experience (design and operating effectiveness, sampling).
• Hands-on SIEM experience (BigQuery / Looker or comparable), detection engineering, and incident-response / threat-hunting execution - not just oversight.
• Incident-response coordination experience and strong security policy / procedure writing skills.
• Ability to support a scheduled on-call rotation for critical incident escalation outside business hours.

Preferred Certifications and Qualifications

• CISSP, CISA, or CMMC CCP / CCA (one or more).
• GIAC (e.g., GCIA, GCIH) or equivalent blue-team certification.
• Prior participation in a CMMC Level 2 (or DFARS / 800-171) assessment strongly preferred.
• Familiarity with FedRAMP inheritance and FIPS-validated cryptography concepts.

Citizenship, Screening and Trust

• U.S. citizenship is required (CUI access and Security Protection function).
• Must pass Ingram Micro background screening and complete CUI handling, insider-threat, and incident-handling training before access.
• Subject to least-privilege access controls and periodic access recertification; the dual compliance-owner / operator scope of this role is independently validated via the third-party KPMG / C3PAO assessment.

Work Model & Conditions

Full-time exempt role based in the U.S.. Occasional travel for the C3PAO assessment and audit activities. Standard business hours with a scheduled on-call rotation for after-hours Sev1/2 incident escalation; extended hours possible during active incidents or the C3PAO assessment window.

The typical base pay range for this role across the U.S. is USD $133,400.00 - $226,800.00 per year.

The ranges above reflect the potential annual base pay across the U.S. for all roles; the applicable base pay range will depend on the candidate's primary work location, pay grade, and variable compensation plan. Individual base pay within each range depends on various factors, in addition to primary work location, such as complexity and responsibility of role, job duties/requirements, and relevant experience and skills. Base pay ranges are reviewed and typically updated each year. Offers are made within the base pay range applicable at the time of hire. New hires starting base pay generally falls in the bottom half (between the minimum and midpoint) of a pay range.

At Ingram Micro certain roles are eligible for additional rewards, including merit increases, annual bonus or sales incentives and long-term incentives. These awards are allocated based on position level and individual performance. U.S.-based employees have access to healthcare benefits, paid time off, parental leave, a 401(k) plan and company match, short-term and long-term disability coverage, basic life insurance, and wellbeing benefits, among others.

This is not a complete listing of the job duties. It's a representation of the things you will be doing, and you may not perform all these duties.

Please be prepared to pass a drug test and successfully pass a pre-employment (post offer) background check.

Ingram Micro Inc. is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, veteran status, or any other protected category under applicable law.