Principal, Information System Security Officer & Security Operations Lead

Ingram Micro; Irvine (CA); Remote; USD 150,000 - 210,000; Full time

Job summary

Ingram Micro Inc. is seeking an experienced ISSO & Security Operations Lead for a remote role based in the United States.

You will own the CUI enclave security posture, maintain the SSP/POA&M, and lead assessments against NIST SP 800-171A while personally operating SIEM during business hours. You will also coordinate the C3PAO certification process, manage SPRS scoring, and supervise incident response, threat hunting, and regulatory reporting activities.

Qualifications

• 7+ years in information security / GRC with CUI or regulated environment experience.
• Deep expertise in NIST SP 800-171 Rev. 2 / 800-171A and CMMC 2.0 Level 2.
• Hands-on SSP and POA&M authoring and control-assessment experience.
• Hands-on SIEM experience (BigQuery / Looker) and incident-response execution.

Responsibilities

• Author, own, and maintain the SSP, POA&M, and security policies for the enclave boundary.
• Lead assessments of 110 practices / 320 objectives against NIST SP 800-171A.
• Calculate and maintain the SPRS score and prepare the annual affirmation package.
• Govern Google Workspace security configuration and SIEM telemetry for detection and response.
• Manage the C3PAO certification engagement and coordination with KPMG pre-audit.

Skills

Information security

Incident response

Threat hunting

SIEM monitoring

Policy writing

NIST SP 800-171A

GRC

Education

Bachelor's degree or higher in cybersecurity

Tools

BigQuery

Looker

Google Workspace security tools

Job description

This is a remote position for candidates located in or near the Washington, DC metropolitan area, including Washington, DC and West Virginia.

U.S. citizenship is required for this role.

Your role:

The ISSO & Security Operations Lead owns the security and compliance posture of the CUI enclave end-to-end — authoring and maintaining the State System Security Plan (SSP) and Plan of Action and Milestones (POA&M), leading control assessments against NIST SP 800-171A, sustaining the SPRS score, and shepherding the organization through Certified Third Party Assessor Organization (C3PAO) certification — while also personally operating the SIEM over enclave telemetry during business hours, triaging alerts, threat hunting, executing incident-response runbooks, and owning DIBNet 72-hour regulatory reporting.

Governance and Compliance:

• Author, own, and continuously maintain the SSP, POA&M, and supporting security policies for the enclave boundary.

• Lead assessments of all 110 practices / 320 objectives against NIST SP 800-171A (Test of Design and Operating Effectiveness), including sampling, evidence collection, and gap remediation.

• Calculate and maintain the SPRS score; prepare the senior-official annual affirmation package.

• Govern Google Workspace security configuration — DLP, Vault, Drive labels/IRM, Context-Aware Access, and unified audit logs.

• Manage the C3PAO certification engagement and the KPMG independent design review, build review, and pre-audit (mock C3PAO).

• Maintain the CUI program: marking, handling, decontrol, retention, and DFARS 252.204-7012 flow-down interpretation with the BU.

• Run the annual self-assessment and continuous-monitoring program; track POA&M closure to schedule.

Security Monitoring and Incident Response:

• Perform business-hours monitoring and detection using the SIEM / BigQuery log store over enclave telemetry; serve as the named on-call escalation point for after-hours Sev1/2 alerts.

• Triage alerts, investigate events, and conduct proactive threat hunting.

• Execute incident response per runbooks SOP-LOG-004 (audit log review) and SOP-INC-008 (incident handling).

• Own DIBNet 72-hour incident reporting and coordinate all regulatory notifications.

• Integrate and tune enclave telemetry sources (Workspace audit logs, WorkSpaces, identity, endpoint).

• Maintain detection content, on-call handover documentation, and post-incident lessons-learned records.

• Contribute monitoring evidence for control assessments and continuous monitoring.

What you bring to the role:

Education

Bachelor's degree or higher in cyber security, computer science/engineering, management of information systems or similar degrees.

Experience

• 7+ years in information security / GRC, with demonstrable CUI or regulated-environment experience.

• Deep, current expertise in NIST SP 800-171 Rev. 2 / 800-171A and CMMC 2.0 Level 2.

• Hands-on SSP and POA&M authoring and control-assessment experience (design and operating effectiveness, sampling).

• Hands-on SIEM experience (BigQuery / Looker or comparable), detection engineering, and incident-response / threat-hunting execution — not just oversight.

• Incident-response coordination experience and strong security policy / procedure writing skills.

• Ability to support a scheduled on-call rotation for critical incident escalation outside business hours.

Preferred Certifications and Qualifications

• CISSP, CISA, or CMMC CCP / CCA (one or more).

• GIAC (e.g., GCIA, GCIH) or equivalent blue-team certification.

• Prior participation in a CMMC Level 2 (or DFARS / 800-171) assessment strongly preferred.

• Familiarity with FedRAMP inheritance and FIPS-validated cryptography concepts.

Citizenship, Screening and Trust

• U.S. citizenship is required (CUI access and Security Protection function).

• Must pass Ingram Micro background screening and complete CUI handling, insider-threat, and incident-handling training before access.

• Subject to least-privilege access controls and periodic access recertification; the dual compliance-owner / operator scope of this role is independently validated via the third-party KPMG / C3PAO assessment.

Work Model & Conditions

Full-time exempt role based in the U.S.. Occasional travel for the C3PAO assessment and audit activities. Standard business hours with a scheduled on-call rotation for after-hours Sev1/2 incident escalation; extended hours possible during active incidents or the C3PAO assessment window.

#LI-SK1

#LI-Remote