Compliance Lead - CMMC (NIST SP 800-171)
Defenseunicorns · Remote
About this role
## Role: Compliance Lead – CMMC (NIST SP 800-171) We are seeking a **CMMC Compliance Lead** to join **Commercial Cyber Operations**. You will serve as the **customer-facing lead** for **CMMC Level 1 and Level 2** engagements, owning **NIST SP 800-171 interpretation, scoping, documentation, and assessment readiness** from kickoff through the **C3PAO assessment** and into sustainment. This is **not** a coordination role. The Compliance Lead scopes the assessment boundary, authors the **System Security Plan** and supporting documentation, directs and (where needed) performs **control implementation**, assesses the environment against the **CMMC Level 2 Assessment Guide**, and supports the customer during assessment week. --- ## Responsibilities - Serve as the **primary point of contact** for assigned customers for the life of the engagement: run kickoff, working sessions, and status reporting; answer CMMC/NIST SP 800-171 questions directly. - **Scope the CMMC assessment boundary**: trace **FCI/CUI flows**, categorize assets per the CMMC Level 2 Scoping Guide (CUI, Security Protection, Contractor Risk Managed, Specialized, Out of Scope), and produce boundary, data-flow, and network diagrams. - Lead each engagement through the standard delivery process from intake to an **assessor-ready package**, holding stage gates and evidence standards. - Author and maintain the **System Security Plan**, policies/procedures, **POA&Ms**, and an evidence library at the assessment-objective level; score self-assessments and **SPRS** submissions under the DoD Assessment Methodology and **32 CFR Part 170**. - Implement technical controls **hands-on** in the customer tenant (e.g., **Entra ID / Google Cloud Identity**, least privilege, privileged-account separation, data protection via **Microsoft Purview** or **Google Workspace DLP**, **FIPS-validated encryption**, configuration baselines). Decide which requirement each setting satisfies and why; coordinate heavier build work with the Technical Implementation Engineer. - Stand up and operate **endpoint management** across Windows, macOS, iOS, and Android using **Microsoft Intune** and **Jamf** (Apple Business Manager, Android Enterprise): enrollment, compliance policies, CIS/DISA STIG baselines, BitLocker/FileVault, patching, removable-media control. - Build and operate the **logging/monitoring stack** (AU/RA/SI): centralized audit logging and alerting in a SIEM (Microsoft Sentinel, Google SecOps, Splunk, or similar), retention/review cadence, vulnerability scanning/remediation tracking, and backup/recovery verification. - Assess the finished environment against the **CMMC Level 2 Assessment Guide** using examine/interview/test methods; run pre-assessment readiness reviews and close gaps before the C3PAO arrives. - Prepare customers for **C3PAO assessments** and support during assessment week (evidence presentation, interview coaching, assessor questions, and post-assessment POA&M closeout). - Run **sustainment**: continuous monitoring cadence, change reviews, annual affirmations, and reassessment readiness. - Improve the practice by turning repeatable work into **templates/checklists/automation** and contributing domain content to internal AI tooling. --- ## Minimum Experience & Qualifications - Experience taking defense contractors through **NIST SP 800-171 / CMMC Level 2** end-to-end, including at least one organization you personally led through a successful **C3PAO or DIBCAC** assessment as consulta
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.