Principal, Information System Security Officer & Security Operations Lead

Ingram Micro • Irvine, CA

6d • $133,400 - $226,800

About The Position

The Principal, Information System Security Officer & Security Operations Lead owns the security and compliance posture of the CUI enclave end-to-end. The role authors and maintains the System Security Plan (SSP), Plan of Action and Milestones (POA&M), and supporting policies; leads assessments against NIST SP 800-171A; maintains the SPRS score; and guides the organization through C3PAO certification. The position also personally operates the SIEM over enclave telemetry during business hours, triages alerts, conducts threat hunting, executes incident-response runbooks, and owns DIBNet 72-hour regulatory reporting.

The role leads governance and compliance activities, including assessing all 110 practices and 320 objectives, managing Google Workspace security configuration, coordinating C3PAO and KPMG reviews, maintaining the CUI program, and running annual self-assessment and continuous-monitoring programs. Security operations responsibilities include integrating and tuning telemetry, maintaining detection content and handover documentation, investigating events, coordinating regulatory notifications, and recording lessons learned.

This is a full-time exempt role based in the U.S. It follows standard business hours, with a scheduled on-call rotation for after-hours critical incident escalation. Occasional travel is required for C3PAO assessment and audit activities; extended hours may be necessary during active incidents or the C3PAO assessment window. The stated U.S. base pay range is USD $133,400 to $226,800 per year, with additional rewards potentially available for eligible roles.

Requirements

• Bachelor's degree or higher in cybersecurity, computer science or engineering, management information systems, or a similar field.
• At least 7 years of experience in information security or GRC, with demonstrable CUI or regulated-environment experience.
• Deep, current expertise in NIST SP 800-171 Rev. 2 / 800-171A and CMMC 2.0 Level 2.
• Hands-on experience authoring SSPs and POA&Ms and conducting control assessments, including design and operating effectiveness testing and sampling.
• Hands-on SIEM experience, such as BigQuery / Looker or comparable tools, along with detection engineering, incident-response, and threat-hunting execution.
• Incident-response coordination experience and strong security policy and procedure writing skills.
• Ability to support a scheduled on-call rotation for critical incident escalation outside business hours.
• U.S. citizenship.
• Must pass Ingram Micro background screening and complete CUI handling, insider-threat, and incident-handling training before access.
• Must comply with least-privilege access controls and periodic access recertification.
• Must be prepared to pass a drug test and successfully pass a pre-employment background check.

Nice To Haves

• One or more of CISSP, CISA, CMMC CCP, or CCA certifications.
• GIAC certification, such as GCIA or GCIH, or an equivalent blue-team certification.
• Prior participation in a CMMC Level 2 or DFARS / 800-171 assessment.
• Familiarity with FedRAMP inheritance and FIPS-validated cryptography concepts.

Responsibilities

• Author, own, and continuously maintain the SSP, POA&M, and supporting security policies for the enclave boundary.
• Lead assessments of all 110 practices and 320 objectives against NIST SP 800-171A, including testing design and operating effectiveness, sampling, evidence collection, and gap remediation.
• Calculate and maintain the SPRS score and prepare the senior-official annual affirmation package.
• Govern Google Workspace security configuration, including DLP, Vault, Drive labels and IRM, Context-Aware Access, and unified audit logs.
• Manage the C3PAO certification engagement and the KPMG independent design review, build review, and pre-audit.
• Maintain the CUI program, including marking, handling, decontrol, retention, and DFARS 252.204-7012 flow-down interpretation with the business unit.
• Run the annual self-assessment and continuous-monitoring program and track POA&M closure to schedule.
• Monitor and detect activity during business hours using the SIEM and BigQuery log store over enclave telemetry, and serve as the named on-call escalation point for after-hours Sev1/2 alerts.
• Triage alerts, investigate events, and conduct proactive threat hunting.
• Execute incident response according to SOP-LOG-004 and SOP-INC-008.
• Own DIBNet 72-hour incident reporting and coordinate regulatory notifications.
• Integrate and tune enclave telemetry sources, including Workspace audit logs, WorkSpaces, identity, and endpoint telemetry.
• Maintain detection content, on-call handover documentation, and post-incident lessons-learned records.
• Contribute monitoring evidence for control assessments and continuous monitoring.

Benefits

• Healthcare benefits
• Paid time off
• Parental leave
• 401(k) plan and company match
• Short-term and long-term disability coverage
• Basic life insurance
• Wellbeing benefits
• Potential merit increases, annual bonus or sales incentives, and long-term incentives for eligible roles

What This Job Offers

• Job Type: Full-time
• Career Level: Principal