CMMC Compliance Manager

This is a fully remote position, open to applicants in United States.

📋 Description

• Assist Cuick Trac® clients in the implementation and upkeep of customer-responsible controls.

• Prepare clients for assessments including C3PAO, DCMA DIBCAC Medium, and DCMA DIBCAC High.

• Convert the Customer Responsibility Matrix into actionable plans for clients.

• Create and validate documentation specific to client inheritance and responsibilities.

• Offer remediation guidance for NIST SP 800-171 and CMMC Level 2 standards.

• Develop documentation related to boundaries, scoping, data flows, user flows, and data management.

• Provide advice on incident response plans, tabletop exercises, physical security remediation, policies, and procedures.

• Conduct gap assessments, risk assessments, and implementation reviews in line with NIST SP 800-171A objectives.

• Create and maintain System Security Plans (SSPs) and Plans of Action and Milestones (POA&Ms), including tracking POA&M closeout.

• Guide clients on CMMC status entries and annual affirmations in the Supplier Performance Risk System (SPRS).

• Compile evidence packages and coach client personnel for assessor interviews and demonstrations.

• Assist clients during assessments and provide guidance for remediation of findings.

• Perform annual compliance reviews.

• Analyze government contracts and solicitations for cybersecurity, Controlled Unclassified Information (CUI), and export-control requirements.

• Develop and manage compliance roadmaps.

• Oversee the Governance, Risk, and Compliance (GRC) tool for assigned clients.

• Carry out additional duties as assigned based on business needs.

⛳️ Requirements

• 2–4 years of experience in customer-facing roles with NIST SP 800-171, NIST SP 800-53, CMMC, and the NIST Risk Management Framework.

• Proficient understanding of DoD cybersecurity clauses, including DFARS 252.204-7012, DFARS 252.204-7021, provision 252.204-7025, DFARS 252.240-7997, and FAR 52.240-93.

• Knowledge that legacy contracts may reference 252.204-7019 and 252.204-7020.

• Familiarity with the CMMC program rule (32 CFR Part 170), including scoping, POA&M, and affirmation requirements.

• Experience with security tools such as firewalls, SIEM, vulnerability management, MFA, endpoint protection, and DLP.

• Background in risk and security assessment processes, along with the ability to track and remediate audit or assessment findings.

• Experience in managing POA&Ms.

• Understanding of DoD cybersecurity policy, governance best practices, and emerging trends.

• Basic knowledge of operating systems, security applications, fundamental network protocols, tools, and infrastructure.

• Excellent written and verbal communication abilities.

• Strong project management skills with the capacity to handle multiple client engagements simultaneously.

• Consultative skills in client management.

• Proficient teaching and coaching skills.

• Exceptional attention to detail.

• Proficiency in Microsoft Office / Microsoft 365.

• Candidates must satisfy applicable U.S. person requirements under relevant export-control regulations.

• Preferred: experience in incident response planning and tabletop exercises.

• Preferred: knowledge of NIST SP 800-171 Revision 3, the FAR CUI rule, and CIRCIA.

• Preferred certifications include CCP, CCA, RP/RPA, CISSP, CISM, CISA, ISO/IEC 27001 Lead Auditor, and Microsoft Azure certifications.

🏝️ Benefits

• Remote position.

• Occasional travel may be required.