Principal, Information System Security Officer & Security Operations Lead

Principal, Information System Security Officer & Security Operations Lead

Accelerate your career. Join the organization that's driving the world's technology and shape the future.

Ingram Micro is a leading technology company for the global information technology ecosystem. With the ability to reach nearly 90% of the global population, we play a vital role in the worldwide IT sales channel, bringing products and services from technology manufacturers and cloud providers to business-to-business technology experts. Our market reach, diverse solutions and services portfolio, and digital platform Ingram Micro Xvantage set us apart. Learn more at www.ingrammicro.com

Come join our team where you’ll make technology happen in surprising ways. Let’s shape tomorrow - it’ll be a fun journey!

This is a remote position for candidates located in or near the Washington, DC metropolitan area, including Washington, DC and West Virginia.

U.S. citizenship is required for this role.

Your role:

The ISSO & Security Operations Lead owns the security and compliance posture of the CUI enclave end-to-end — authoring and maintaining the State System Security Plan (SSP) and Plan of Action and Milestones (POA&M), leading control assessments against NIST SP 800-171A, sustaining the SPRS score, and shepherding the organization through Certified Third Party Assessor Organization (C3PAO) certification — while also personally operating the SIEM over enclave telemetry during business hours, triaging alerts, threat hunting, executing incident-response runbooks, and owning DIBNet 72-hour regulatory reporting.

Governance and Compliance:

• Author, own, and continuously maintain the SSP, POA&M, and supporting security policies for the enclave boundary.

• Lead assessments of all 110 practices / 320 objectives against NIST SP 800-171A (Test of Design and Operating Effectiveness), including sampling, evidence collection, and gap remediation.

• Calculate and maintain the SPRS score; prepare the senior-official annual affirmation package.

• Govern Google Workspace security configuration — DLP, Vault, Drive labels/IRM, Context-Aware Access, and unified audit logs.

• Manage the C3PAO certification engagement and the KPMG independent design review, build review, and pre-audit (mock C3PAO).

• Maintain the CUI program: marking, handling, decontrol, retention, and DFARS 252.204-7012 flow-down interpretation with the BU.

• Run the annual self-assessment and continuous-monitoring program; track POA&M closure to schedule.

Security Monitoring and Incident Response:

• Perform business-hours monitoring and detection using the SIEM / BigQuery log store over enclave telemetry; serve as the named on-call escalation point for after-hours Sev1/2 alerts.

• Triage alerts, investigate events, and conduct proactive threat hunting.

• Execute incident response per runbooks SOP-LOG-004 (audit log review) and SOP-INC-008 (incident handling).

• Own DIBNet 72-hour incident reporting and coordinate all regulatory notifications.

• Integrate and tune enclave telemetry sources (Workspace audit logs, WorkSpaces, identity, endpoint).

• Maintain detection content, on-call handover documentation, and post-incident lessons-learned records.

• Contribute monitoring evidence for control assessments and continuous monitoring.

What you bring to the role:

Education

• Bachelor's degree or higher in cyber security, computer science/engineering, management of information systems or similar degrees.

Experience

• 7+ years in information security / GRC, with demonstrable CUI or regulated-environment experience.

• Deep, current expertise in NIST SP 800-171 Rev. 2 / 800-171A and CMMC 2.0 Level 2.

• Hands-on SSP and POA&M authoring and control-assessment experience (design and operating effectiveness, sampling).

• Hands-on SIEM experience (BigQuery / Looker or comparable), detection engineering, and incident-response / threat-hunting execution — not just oversight.

• Incident-response coordination experience and strong security policy / procedure writing skills.

• Ability to support a scheduled on-call rotation for critical incident escalation outside business hours.

• Preferred Certifications and Qualifications

• CISSP, CISA, or CMMC CCP / CCA (one or more).

• GIAC (e.g., GCIA, GCIH) or equivalent blue-team certification.

• Prior participation in a CMMC Level 2 (or DFARS / 800-171) assessment strongly preferred.

• Familiarity with FedRAMP inheritance and FIPS-validated cryptography concepts.

• Citizenship, Screening and Trust

• U.S. citizenship is required (CUI access and Security Protection function).

• Must pass Ingram Micro background screening and complete CUI handling, insider-threat, and incident-handling training before access.

• Subject to least-privilege access controls and periodic access recertification; the dual compliance-owner / operator scope of this role is independently validated via the third-party KPMG / C3PAO assessment.

• Work Model & Conditions

• Full-time exempt role based in the U.S.. Occasional travel for the C3PAO assessment and audit activities. Standard business hours with a scheduled on-call rotation for after-hours Sev1/2 incident escalation; extended hours possible during active incidents or the C3PAO assessment window.