Chief Information Security Officer ( CISO )

Full timeHybrid Phoenix, AZAbout the CompanyFounded in 1992, Mi-Case is the industry leader in fully integrated offender management software solutions and provides industry expertise and consulting within Criminal Justice and Public Safety systems. Mi-Case leverages a unique combination of technical, functional and industry specialization as well as partnerships with key software vendors to deliver maximum value add projects.About the RoleThe Chief Information Security Officer (CISO) is responsible for establishing and leading the enterprise-wide information security strategy, program, and governance across Mi-Case. Reporting directly to the CTO, the CISO serves as the senior-most authority on all matters related to cybersecurity, data protection, regulatory compliance, and risk management. This leader will build and mature Mi-Case's security posture in alignment with the specialized compliance requirements of the Criminal Justice and Public Safety sector, including CJIS 6.0, FedRAMP, ISO 27001, and SOC 2 frameworks. The CISO partners closely with executive leadership, product and engineering teams, and clients to ensure that security is embedded across the organization and that Mi-Case maintains the trust of the agencies and communities it serves.ResponsibilitiesSecurity Strategy & GovernanceDevelop, implement, and maintain a comprehensive enterprise information security strategy aligned with Mi-Case's business objectives and client commitmentsEstablish and oversee the information security governance framework, policies, standards, and procedures across all business unitsServe as the primary security advisor to the CEO, CTO, and executive leadership team; provide regular security briefings and risk reportingEvaluate and integrate AI-assisted security tools and practices to enhance threat detection, incident response, and security automation capabilitiesDefine and track key security metrics, KPIs, security program maturity assessments, and risk indicators; present findings to leadership and the board of directorsOwn and manage the information security budget; develop annual budget plans and justify security investments to executive leadership and the boardCompliance & RegulatoryOwn and drive compliance with Criminal Justice Information Services (CJIS) Security Policy requirements, including leading the organization's transition to CJIS 6.0 compliance (phishing-resistant MFA, FIPS 140-3 encryption, updated cloud security controls), across all applicable products, systems, and operationsLead and maintain FedRAMP authorization and ongoing Continuous Monitoring (ConMon) efforts, including coordination with Third Party Assessment Organizations (3PAOs), federal agency sponsors, monthly vulnerability scanning, POA&M management, and annual assessmentsMaintain SOC 2 Type II compliance program; coordinate with external auditors and ensure continuous control effectivenessOwn and maintain the ISO 27001 Information Security Management System (ISMS), including internal audit coordination, management reviews, risk treatment plans, and certification body engagementEnsure compliance with data privacy, data residency, and data sovereignty requirements applicable to justice and public safety clientsMonitor evolving federal, state, and sector-specific regulatory requirements and ensure Mi-Case remains ahead of compliance obligationsOversee cyber insurance program; coordinate with legal counsel on security-related contractual obligations, breach response requirements, and regulatory reportingServe as the primary point of contact for client security assessments, audits, and questionnairesSupport sales engagements, RFP/RFI responses, and proactive security relationship-building with client CISOs and security teamsIncident Response & Threat ManagementDevelop, maintain, and regularly test the enterprise incident response plan, including tabletop exercises and simulation drillsOversee or establish Security Operations Center (SOC) capabilities, including SIEM implementation, 24/7 monitoring, and continuous threat detection aligned with FedRAMP ConMon and CJIS requirementsLead the organization's response to security incidents, breaches, and threats; serve as the executive decision-maker during active incidentsOversee vulnerability management, penetration testing, and threat intelligence programsManage relationships with external security partners, managed security service providers (MSSPs), and law enforcement contacts as neededEnsure timely and accurate breach notification processes in compliance with applicable laws and client contractual obligationsSecurity Awareness & TrainingDesign and operate an enterprise-wide security awareness and training program that addresses role-specific risks and regulatory requirementsBuild a culture of security awareness across all departments, ensuring employees understand their responsibilities under CJIS, company policy, and client agreementsDevelop specialized training for technical staff, including secure coding practices, data handling, and AI tool usage governanceTrack training completion rates and measure program effectiveness; continuously improve content based on threat landscape changesArchitecture & Engineering PartnershipCollaborate with product, engineering, and DevOps teams to ensure security-by-design principles are embedded in the software development lifecycleReview and approve security architecture for new products, features, and infrastructure changesOversee identity and access management (IAM), encryption standards, and data classification frameworks, and data residency/sovereignty controls for government clientsOversee AWS cloud security posture, including AWS GovCloud environments, leveraging AWS security services (GuardDuty, Security Hub, CloudTrail, Config, KMS, WAF) and ensuring alignment with the AWS Shared Responsibility ModelManage software supply chain security, including Software Bill of Materials (SBOM), dependency vulnerability scanning, secure CI/CD pipeline controls, and code signingOwn the application security (AppSec) program, including SAST/DAST/SCA tooling, secure code review standards, security release gates, and a responsible disclosure/vulnerability reporting processEnsure physical security controls for remote workers handling CJI, including compliance with CJIS 6.0 remote work requirementsDefine and drive adoption of Zero Trust architecture principles across the organization in alignment with federal mandates (OMB M-22-09)Business Continuity & Disaster RecoveryDevelop, maintain, and regularly test business continuity and disaster recovery (BC/DR) plans in compliance with CJIS, FedRAMP (CP control family), and , and ISO 27001 (Annex A.17) requirements • Ensure BC/DR plans address CJI data protection, AWS infrastructure resilience, and client SLA commitmentsVendor & Third-Party RiskEstablish and manage a third-party risk management program, including vendor security assessments and contract security requirementsEnsure cloud service providers and technology partners meet Mi-Case's and clients' security standardEducational and Training Requirements • Bachelor’s degree in computer science, Information Security, Information Technology, or a related field required• Master's degree preferred • Active security certifications required or expected within 12 months: CISSP, CISM, or equivalent• CJIS Security Awareness Training certification required or obtainable within 90 days of hire• Preferred certifications: CCSP (Certified Cloud Security Professional), AWS Certified Security — Specialty, CISA (Certified Information Systems Auditor), FedRAMP training/certificationKnowledge, Skills, and Abilities • 10+ years of progressive information security experience, with at least 3–5 years in a senior security leadership role• Deep knowledge of CJIS Security Policy (including version 6.0) and experience implementing compliant programs within a software or technology organization• Demonstrated experience leading or maintaining FedRAMP Authorization to Operate (ATO) efforts and ongoing Continuous Monitoring (ConMon) programs• Proven experience managing SOC 2 Type II compliance programs• Strong understanding of security frameworks including NIST CSF, NIST 800-53, ISO 27001, and CIS Controls; experience implementing or maintaining an ISO 27001 ISMS strongly preferred• Experience building and running incident response programs, including leading active incident management• Proven ability to design and deliver effective security awareness and training programs across diverse audiences• Experience evaluating and governing AI-assisted security tools; understanding of AI risk in a security context• Excellent executive communication skills — ability to translate complex technical risk into clear business language for non-technical audiences• Experience working in or with Criminal Justice, Public Safety, or Government sectors strongly preferred• Deep understanding of CJIS Security Policy version 6.0, including phishing-resistant MFA, FIPS 140-3 encryption, and updated cloud computing security requirements • Experience securing AWS environments, including AWS GovCloud, and working knowledge of AWS security services (GuardDuty, Security Hub, IAM, KMS, CloudTrail, Config, WAF)• Understanding of data privacy, data residency, and data sovereignty requirements for government clients, including PII/CJI lifecycle management• Experience with cyber insurance programs and coordination with legal counsel on security matters, breach response, and contractual obligations• Familiarity with Zero Trust architecture principles and federal Zero Trust mandates (OMB M-22- 09)• Demonstrated ability to build and lead security teams and manage external security vendors and partner