Information Security and Compliance Manager

Information Security and Compliance Manager

Department

Information Technology

Reports To

Director of IT

Classification

Exempt / Full-Time

Location

Elkhart, IN

Frameworks

CMMC Level 2 (C3PAO), TISAX Level 3, SOX ITGCs, PCI-DSS, ISO 9001

Position Summary

This is a founding security role — our first dedicated information security hire, functioning as a de facto individual-contributor CISO. Reporting to the Director of IT, you will design, implement, and own the company's information security program and serve as the hands-on accountable owner across a portfolio of regulatory frameworks for a modest-sized discrete manufacturer as an internationally operating Business Unit of a larger conglomerate. You will do the work directly: writing policy, managing audits, maintaining evidence, and tracking compliance obligations — while communicating clearly with leadership and external auditors.

Key Responsibilities

Security Program

•    Build and maintain the company ISMS: policies, standards, risk register, and control framework.

•    Own the vulnerability management program, security architecture reviews, and Incident Response plan.

•    Manage the vendor/third-party risk program, including security requirements in supplier contracts.

•    Administer annual security awareness training and phishing simulation program.

•    Report program status, open risks, and compliance calendar to the Director of IT.

CMMC Level 2 (C3PAO)

•    Own the System Security Plan (SSP), POA&M, and CUI environment boundary documentation.

•    Serve as primary contact for C3PAO assessments; maintain audit-ready posture year-round.

•    Manage DFARS 252.204-7021 obligations and any subcontractor security flow-down requirements.

TISAX Level 3

•    Own the full TISAX assessment lifecycle: scoping, VDA ISA gap analysis, remediation, and ENX audit coordination.

•    Maintain the TISAX label and manage exchange requests; support OEM/Tier-1 customer verification requirements.

SOX IT General Controls

•    Own ITGC design and evidence across logical access, change management, and computer operations.

•    Serve as primary liaison to external financial auditors for ITGC walkthroughs and evidence delivery.

•    Manage access certifications, privileged access reviews, and separation of duties controls.

PCI-DSS

•    Own CDE scope, network segmentation documentation, and annual ROC/SAQ process with QSA.

•    Maintain ASV scanning and penetration testing schedules; drive remediation of findings.

Contract Compliance Requirements Tracking (ISO 9001 Support)

•    Maintain a contract requirements register capturing security, data handling, and compliance obligations from customer and supplier contracts — supporting the company's ISO 9001 QMS.

•    Review incoming contracts for security and IT compliance obligations; communicate requirements to relevant teams and track fulfillment.

•    Partner with the Quality Manager on internal audits where contract requirements intersect with IT controls.

Qualifications

Required

•    5 years in information security and/or IT compliance.

•    Experience as the primary security owner or sole practitioner — comfortable building, not just inheriting.

•    Experience as an auditor or managed third-party auditors directly (C3PAO, QSA, or external financial auditors).

•    Reviewed contracts for security/compliance obligations and translated them into actionable IT requirements.

•    Proficiency with vulnerability management, SIEM, IAM/MFA, and endpoint protection tooling.

•    Strong written communication: policy writing, SSPs, control narratives, and executive summaries.

Preferred

•    Direct, hands-on experience managing preparation for at least two of: CMMC/NIST 800-171, TISAX, SOX ITGCs, PCI-DSS.

•    Background in defense manufacturing, automotive supply chain, or regulated SME manufacturing.

•    CISSP, CISM, CISA, or equivalent certification (or active pursuit within 12 months).

•    CMMC Registered Practitioner (RP) or Certified Professional (CP).

•    PCI-ISA or QSA credential.

•    Experience with Microsoft 365 / Entra ID in a compliance-scoped environment.

•    Familiarity with GRC platforms (Drata, Vanta, Archer, or similar).

•    Exposure to ITAR/EAR requirements as they intersect with information security.

Who You Are

•    Ownership mentality — you build the program, not just maintain a checklist.

•    Practitioner first — comfortable writing the SSP and presenting to the CFO in the same week.

•    Multi-framework fluency — you hold CMMC, TISAX, SOX, and PCI context simultaneously.

•    Collaborative — you get compliance outcomes by working with operations, not around them.

•    Detail-oriented — audit-ready records are your professional standard, not a pre-audit sprint and you read agreements for business obligations as a matter of routine.

•    Right-sized mindset — you know how to apply enterprise-grade thinking pragmatically in a SME.