Governance, Risk, and Compliance Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Take charge of the complete CMMC implementation and audit readiness process, which encompasses scoping, control mapping, SSP and POA&M development, evidence gathering, and tracking remediation efforts.

• Analyze and apply DFARS clause requirements, including DFARS 252.204-7012, 252.204-7019, and 252.204-7020, converting contractual obligations into operational controls while ensuring accurate SPRS submissions.

• Perform regular internal audits of NIST 800-171 security controls on a predetermined schedule to ensure ongoing compliance, and assist in preparing for C3PAO assessments, including evidence packages and logistics for assessments.

• Evaluate CUI environments to satisfy CMMC boundary requirements, such as network segmentation, access control, media protection, and FIPS-validated encryption, while assessing cloud environments against CMMC scoping guidelines.

• Execute technical controls across NIST 800-171 practice families, which include MFA, audit logging, configuration management, incident response, and vulnerability management.

• Act as a CMMC subject matter expert, contributing to compliance roadmaps, leading readiness workshops, and providing guidance on DFARS flow-down obligations for subcontractors.

• Work alongside legal and contracts teams to review FAR/DFARS clauses in both new and existing contracts, highlighting CUI obligations and CMMC level demands, and coordinate on ITAR and EAR responsibilities as they relate to CUI management.

• Assist in managing the organization’s GRC platform for evidence management, POA&M tracking, and maintaining the risk register, while contributing to compliance dashboards for leadership.

⛳️ Requirements

• 2–4 years of professional experience in cybersecurity, compliance, or IT security, with hands-on experience in NIST SP 800-171 or CMMC compliance initiatives.

• Experience in developing or contributing to SSPs, POA&Ms, and assessment artifacts, as well as participating in the scoping of CUI environments.

• Familiarity with DFARS cybersecurity clauses (7012, 7019, 7020) and the CMMC 2.0 framework.

• A technical background in systems administration, cloud security, or security engineering that enables effective collaboration with IT and engineering teams on control implementation.

• Bachelor’s degree in Computer Science, Information Security, or equivalent practical experience.

🏝️ Benefits

• Comprehensive medical, dental, and vision plans

• Matching 401K

• Unlimited PTO and paid holidays

• Parental/adoption leave

• Legal insurance

• Home technology stipend