Compliance Lead – CMMC, NIST SP 800-171

This is a fully remote position, open to applicants in United States.

📋 Description

• Act as the main point of contact for customers during each engagement, encompassing kickoff meetings, working sessions, status updates, and addressing inquiries related to CMMC and NIST SP 800-171.

• Define the boundaries of CMMC assessments by mapping FCI and CUI flows, categorizing assets, and creating boundary, data-flow, and network diagrams.

• Guide engagements from initial intake to the production of an assessor-ready package while upholding stage gates and evidence standards.

• Draft and update System Security Plans, policies, procedures, POA&Ms, and evidence libraries.

• Evaluate self-assessments and SPRS submissions according to the DoD Assessment Methodology and 32 CFR Part 170.

• Implement identity management, multi-factor authentication, conditional access, least privilege, separation of privileged accounts, data protection, FIPS-validated encryption, and configuration baselines within customer environments.

• Manage endpoint operations across Windows, macOS, iOS, and Android platforms using Microsoft Intune and Jamf.

• Develop and manage centralized audit logging, SIEM alerting, log retention and review, vulnerability scanning, remediation tracking, and backup/recovery verification.

• Evaluate environments against the CMMC Level 2 Assessment Guide utilizing examination, interviews, and testing methods.

• Conduct pre-assessment readiness reviews and address gaps prior to C3PAO assessments.

• Prepare and support customers during C3PAO assessments, which includes evidence presentation, interview coaching, assisting with assessor inquiries, and closing out POA&Ms.

• Maintain ongoing compliance through continuous monitoring, change reviews, annual affirmations, and readiness for reassessment.

• Enhance compliance delivery with templates, checklists, automation, and contributions to internal AI tools.

⛳️ Requirements

• Proven experience guiding defense contractors through NIST SP 800-171 / CMMC Level 2 engagements from start to finish, including personally leading at least one successful C3PAO or DIBCAC assessment.

• Proficient in writing assessor-ready System Security Plans at the assessment-objective level, along with policies, procedures, POA&Ms, and data-flow and network diagrams.

• Practical experience implementing NIST SP 800-171 technical controls in Microsoft 365 GCC High or Google Workspace.

• Experience in endpoint management across Windows and macOS; familiarity with iOS and Android is advantageous.

• Knowledge of Microsoft Intune or Jamf, including aspects such as enrollment, compliance and configuration policies, disk encryption, patch management, and hardening baselines.

• Experience in centralizing audit logs and alerts within a SIEM or logging platform, such as Microsoft Sentinel, Google SecOps, or Splunk.

• Skilled in operating vulnerability scanning, patch management, and backup processes.

• Understanding of firewalls, VPNs, secure remote access, segmentation, DNS, and wireless networking.

• Strong customer-facing leadership abilities, skilled in meeting facilitation, clear explanation of requirements, decision documentation, and independent project delivery.

• Capability to manage 4–6 concurrent engagements and provide status updates in a remote, asynchronous environment using tools like Slack, Notion, and Google Workspace.

• CMMC Certified Assessor (CCA) is highly preferred; at a minimum, CMMC Certified Professional (CCP) is required.

• Lead CCA designation or Registered Practitioner Advanced (RPA) is a plus.

• Familiarity with both Google Workspace and Microsoft 365 GCC High, including GCC High migrations and NIST SP 800-171 configurations.

• Experience with Apple Business Manager, Android Enterprise, Microsoft Defender for Endpoint, Microsoft Purview, Microsoft Sentinel, Google SecOps, CIS Benchmarks, DISA STIG hardening, Windows Server, and Active Directory is preferred.

• Knowledge of CUI enclave design and migration, GCC High, Azure Government, AWS GovCloud, on-premises enclaves, FedRAMP Moderate equivalency evaluation, and scoping for external service providers is preferred.

• Willingness to travel 10%–25% for customer kickoffs, on-site readiness reviews, and C3PAO assessment weeks.

🏝️ Benefits

• Medical, dental, and vision insurance.

• Company-paid premiums at 100%.

• Health Savings Account.

• Life insurance.

• Disability insurance.

• 401(k) retirement plan.

• Company stock options.

• Home office budget.

• Flexible Time Off (FTO).

• Federal holidays.

• One week off for Thanksgiving.

• Two weeks off for Christmas and New Year's.

• Paid parental leave.

• Reimbursement for approved training and subscriptions.

• Participation in conferences, including travel, lodging, and fees.