Information Security Officer Job McKinney Texas USA,IT/Tech

Position: INFORMATION SECURITY OFFICER

Develop, implement, and continuously update RPM's enterprise information security strategy, policies, and standards, aligned with business objectives and industry frameworks (NIST CSF, NIST SP 800-171, CMMC 2.0, ISO 27001).
Serve as the primary point of accountability for information security decisions, presenting risk posture, incident trends, and program maturity to executive leadership on a regular cadence.
Own the company's information security governance structure, including policy review cycles, exception handling, and security committee coordination.
Maintain a multi-year security roadmap that balances regulatory obligations, cyber insurance requirements, and the operational realities of a construction and development environment, including field offices, job trailers, project management systems, and connected job-site equipment.

Regulatory & Federal Contract Compliance

Own compliance with cybersecurity requirements tied to RPM's federal, DoD, and government-adjacent construction contracts, including CMMC 2.0 (Levels 1-2) and NIST SP 800-171, and monitor the phased CMMC rollout (in effect since November 2025) for changes affecting current and upcoming bids.
Ensure proper identification, marking, and protection of Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) across project documentation, estimating, and file-sharing systems.
Maintain and update the System Security Plan (SSP), Plan of Action and Milestones (POA&M), and supporting evidence needed for CMMC self-assessments, third-party assessments (C3

PAO), and DFARS /7019/7020 flow-down requirements.
Track evolving federal, state, and industry compliance requirements, including cyber insurance underwriting standards and client contractual security clauses, and translate them into actionable internal controls.
Act as RPM's point of contact for compliance audits, client security questionnaires, and insurance carrier risk assessments.
Lead enterprise cybersecurity risk assessments across corporate IT, project sites, and third-party or subcontractor systems; maintain a prioritized risk register with remediation owners and timelines.
Evaluate and manage security risk associated with vendors, subcontractors, design partners, and cloud or SaaS platforms used for project management, estimating, accounting, and document control.
Partner with Legal and Procurement to ensure security requirements are included in subcontractor, vendor, and client contracts.

Incident Response & Operations

Own and maintain RPM's incident response plan, including detection, containment, eradication, recovery, and post-incident review procedures.
Lead the response to security incidents, data breaches, and suspected fraud, including wire and payment fraud, a common risk in construction payment workflows, coordinating with IT, Legal, executive leadership, and external forensics or legal counsel as needed.
Oversee security monitoring, logging, and alerting across corporate networks, cloud environments, and remote or job-site connectivity.
Ensure timely notification obligations are met for clients, regulators, and insurance carriers in the event of a reportable incident.

Security Architecture & Technical Oversight

Partner with IT leadership to ensure secure architecture, configuration, and access controls across networks, endpoints, cloud platforms, project management/ERP systems, and remote job-site connectivity.
Oversee identity and access management practices, including least-privilege access, multi-factor authentication, and periodic access reviews for corporate and field personnel.
Review and approve security requirements for new technology deployments, including project management software, drone or GPS survey data systems, and connected job-site equipment.

Training & Culture

Design and deliver company-wide security awareness training, including phishing and social-engineering simulations, tailored to both office staff and field or project personnel.
Build a culture of security accountability across all levels of the organization, from executive leadership to project superintendents and site staff.

Reporting & Documentation

Maintain accurate, audit-ready documentation of policies, risk assessments, control evidence, and training records.
Prepare periodic security posture reports and metrics for executive leadership and, where applicable, the board or ownership group.

Qualifications
Education

Bachelor's degree in Information Security, Computer Science, Information Technology, or a related field required;
Master's degree preferred.

Experience

7+ years of progressive experience in information security, risk management, or IT compliance, including at least 3 years in a leadership role.
Demonstrated experience supporting compliance with CMMC, NIST SP 800-171, or similar federal/defense contracting cybersecurity requirements strongly preferred.
Experience in construction, engineering, real estate development, or another project-based industry is a plus, but not required.

Certifications…