Chief Information Security Officer ( CISO )

Chief Information Security Officer (CISO) Founded in 1992, Mi-Case is the industry leader in fully integrated offender management software solutions and provides industry expertise and consulting within Criminal Justice and Public Safety systems. Mi-Case leverages a unique combination of technical, functional and industry specialization as well as partnerships with key software vendors to deliver maximum value add projects. The Chief Information Security Officer (CISO) is responsible for establishing and leading the enterprise-wide information security strategy, program, and governance across Mi-Case. Reporting directly to the CTO, the CISO serves as the senior-most authority on all matters related to cybersecurity, data protection, regulatory compliance, and risk management. This leader will build and mature Mi-Case's security posture in alignment with the specialized compliance requirements of the Criminal Justice and Public Safety sector, including CJIS 6.0, FedRAMP, ISO 27001, and SOC 2 frameworks. The CISO partners closely with executive leadership, product and engineering teams, and clients to ensure that security is embedded across the organization and that Mi-Case maintains the trust of the agencies and communities it serves.

Own and drive compliance with Criminal Justice Information Services (CJIS) Security Policy requirements, including leading the organization's transition to CJIS 6.0 compliance (phishing-resistant MFA, FIPS 140-3 encryption, updated cloud security controls), across all applicable products, systems, and operations Lead and maintain FedRAMP authorization and ongoing Continuous Monitoring (ConMon) efforts, including coordination with Third Party Assessment Organizations (3PAOs), federal agency sponsors, monthly vulnerability scanning, POA&M management, and annual assessments Maintain SOC 2 Type II compliance program; coordinate with external auditors and ensure continuous control effectiveness Own and maintain the ISO 27001 Information Security Management System (ISMS), including internal audit coordination, management reviews, risk treatment plans, and certification body engagement Ensure compliance with data privacy, data residency, and data sovereignty requirements applicable to justice and public safety clients Monitor evolving federal, state, and sector-specific regulatory requirements and ensure Mi-Case remains ahead of compliance obligations Oversee cyber insurance program; coordinate with legal counsel on security-related contractual obligations, breach response requirements, and regulatory reporting Serve as the primary point of contact for client security assessments, audits, and questionnaires Support sales engagements, RFP/RFI responses, and proactive security relationship-building with client CISOs and security teams Incident Response & Threat Management Develop, maintain, and regularly test the enterprise incident response plan, including tabletop exercises and simulation drills Oversee or establish Security Operations Center (SOC) capabilities, including SIEM implementation, 24/7 monitoring, and continuous threat detection aligned with FedRAMP ConMon and CJIS requirements Lead the organization's response to security incidents, breaches, and threats; serve as the executive decision-maker during active incidents Oversee vulnerability management, penetration testing, and threat intelligence programs Manage relationships with external security partners, managed security service providers (MSSPs), and law enforcement contacts as needed Ensure timely and accurate breach notification processes in compliance with applicable laws and client contractual obligations Security Awareness & Training Design and operate an enterprise-wide security awareness and training program that addresses role-specific risks and regulatory requirements Build a culture of security awareness across all departments, ensuring employees understand their responsibilities under CJIS, company policy, and client agreements Develop specialized training for technical staff, including secure coding practices, data handling, and AI tool usage governance Track training completion rates and measure program effectiveness; continuously improve content based on threat landscape changes Architecture & Engineering Partnership Collaborate with product, engineering, and DevOps teams to ensure security-by-design principles are embedded in the software development lifecycle Review and approve security architecture for new products, features, and infrastructure changes Oversee identity and access management (IAM), encryption standards, and data classification frameworks, and data residency/sovereignty controls for government clients Oversee AWS cloud security posture, including AWS GovCloud environments, leveraging AWS security services (GuardDuty, Security Hub, CloudTrail, Config, KMS, WAF) and ensuring alignment with the AWS Shared Responsibility ModelManage software supply chain security, including Software Bill of Materials (SBOM), dependency vulnerability scanning, secure CI/CD pipeline controls, and code signing Own the application security (AppSec) program, including SAST/DAST/SCA tooling, secure code review standards, security release gates, and a responsible disclosure/vulnerability reporting process Ensure physical security controls for remote workers handling CJI, including compliance with CJIS 6.0 remote work requirements Define and drive adoption of Zero Trust architecture principles across the organization in alignment with federal mandates (OMB M-22-09) Business Continuity & Disaster Recovery Develop, maintain, and regularly test business continuity and disaster recovery (BC/DR) plans in compliance with CJIS, FedRAMP (CP control family), and ISO 27001 (Annex A.17) requirements Ensure BC/DR plans address CJI data protection, AWS infrastructure resilience, and client SLA commitments Vendor & Third-Party Risk Establish and manage a third-party risk management program, including vendor security assessments and contract security requirements Ensure cloud service providers and technology partners meet Mi-Case's and clients' security standards Educational and Training Requirements Bachelor's degree in computer science, Information Security, Information Technology, or a related field required Master's degree preferred Active security certifications required or expected within 12 months: CISSP, CISM, or equivalentCJIS Security Awareness Training certification required or obtainable within 90 days of hire Preferred certifications: CCSP (Certified Cloud Security Professional), AWS Certified Security Specialty, CISA (Certified Information Systems Auditor), FedRAMP training/certification Knowledge, Skills, and Abilities 10+ years of progressive information security experience, with at least 35 years in a senior security leadership role Deep knowledge of CJIS Security Policy (including version 6.0) and experience implementing compliant programs within a software or technology organization Demonstrated experience leading or maintaining FedRAMP Authorization to Operate (ATO) efforts and ongoing Continuous Monitoring (ConMon) programs Proven experience managing SOC 2 Type II compliance programs Strong understanding of security frameworks including NIST CSF, NIST 800-53, ISO 27001, and CIS Controls; experience implementing or maintaining an ISO 27001 ISMS strongly preferred Experience building and running incident response programs, including leading active incident management Proven ability to design and deliver effective security awareness and training programs across diverse audiencesExperience evaluating and governing AI-assisted security tools; understanding of AI risk in a security context Excellent executive communication skills ability to translate complex technical risk into clear business language for non-technical audiencesExperience working in or with Criminal