Compliance Lead - CMMC (NIST SP 800-171)

Role Description

We are seeking a CMMC Compliance Lead to join Commercial Cyber Operations. This person is the customer-facing lead for CMMC Level 1 and Level 2 engagements and owns NIST SP 800-171 interpretation, scoping, documentation, and assessment readiness from kickoff through the C3PAO assessment and into sustainment. Compliance Lead decides what the systems must satisfy, can configure the controls personally in Google Workspace or Microsoft 365 GCC High, writes the record that proves it, and verifies the result the way an assessor would.

This is not a coordination role. The Compliance Lead scopes the assessment boundary, authors the System Security Plan and supporting documentation, directs and where needed performs control implementation, assesses the finished environment against the CMMC Level 2 Assessment Guide, and stands next to the customer during the assessment. They are the day-to-day point of contact for their assigned customers and answer CMMC questions with authority and in plain terms. Customer environments vary: Windows and macOS fleets, GCC High and Google Workspace tenants, Jamf and Intune, cloud and on-prem enclaves. This person has to be versatile enough to work in all of them.

Responsibilities

The listed responsibilities are not exhaustive and additional responsibilities may be assigned based on the evolving needs of the organization. We are seeking a dynamic individual who is able to adapt and take on new responsibilities as they arise.

• Serve as the primary point of contact for assigned customers for the life of the engagement: run kickoff, working sessions, and status reporting; answer CMMC and NIST SP 800-171 questions directly and accurately without escalation.

• Scope the CMMC assessment boundary: trace FCI and CUI flows, categorize assets per the CMMC Level 2 Scoping Guide (CUI, Security Protection, Contractor Risk Managed, Specialized, Out of Scope), and produce the boundary, data-flow, and network diagrams.

• Lead each engagement through the standard delivery process from intake to assessor-ready package, holding the stage gates and evidence standards.

• Author and maintain the System Security Plan, policies and procedures, POA&M, and evidence library at the assessment-objective level; score self-assessments and SPRS submissions under the DoD Assessment Methodology and 32 CFR Part 170.

• Implement the technical controls hands-on in the customer tenant: identity, MFA, and conditional access in Entra ID or Google Cloud Identity; least privilege and privileged-account separation; data protection in Microsoft Purview or Google Workspace DLP; FIPS-validated encryption; configuration baselines. Decide which requirement each setting satisfies and why, and split the heavier build work with the Technical Implementation Engineer.

• Stand up and operate endpoint management across Windows, macOS, iOS, and Android with Microsoft Intune and Jamf (Apple Business Manager, Android Enterprise): enrollment, compliance policies, CIS or DISA STIG baselines, BitLocker and FileVault, patching, and removable-media control.

• Build the logging and monitoring stack the AU, RA, and SI practices require: centralized audit logging and alerting in a SIEM (Microsoft Sentinel, Google SecOps, Splunk, or similar), log retention and review cadence, vulnerability scanning and remediation tracking, and backup and recovery verification.

• Assess the finished environment against the CMMC Level 2 Assessment Guide using examine, interview, and test methods; run the pre-assessment readiness review and close gaps before the C3PAO arrives.

• Prepare customers for C3PAO assessments and support them during assessment week: evidence presentation, interview coaching, assessor questions, and post-assessment POA&M closeout.

• Run sustainment for customers: continuous monitoring cadence, change reviews, annual affirmations, and reassessment readiness.

• Improve the practice: turn repeatable work into templates, checklists, and automation, and contribute domain content to the team's internal AI tooling.

Minimum Experience and Qualifications

• Experience taking defense contractors through NIST SP 800-171 / CMMC Level 2 end to end, from scoping through assessment, including at least one organization you personally led through a successful C3PAO or DIBCAC assessment as the consultant, assessor, or internal compliance lead.

• Proven ability to write assessor-ready documentation: System Security Plans at the assessment-objective level, policies and procedures, POA&Ms, and data-flow and network diagrams.

• Hands-on experience implementing NIST SP 800-171 technical controls yourself in Microsoft 365 GCC High (Entra ID, Intune, Purview, Defender) or Google Workspace (Admin console, Cloud Identity, context-aware access, endpoint management): the admin-console work, not only the policy; able to validate what an implementation engineer built rather than accept a screenshot.

• Endpoint management experience across Windows and macOS (iOS and Android a plus) with at least one of Microsoft Intune or Jamf: enrollment, compliance and configuration policies, disk encryption, patching, and hardening baselines.

• Experience centralizing audit logs and alerts in a SIEM or log platform (Microsoft Sentinel, Google SecOps, Splunk, or similar) and operating vulnerability scanning, patch management, and backup to satisfy the AU, RA, SI, and MP practices.

• Working knowledge of networking and perimeter controls (firewalls, VPN and secure remote access, segmentation, DNS, wireless), enough to scope the boundary and verify the SC practices.

• Customer-facing lead: runs meetings, explains requirements in plain terms to executives and IT staff, documents decisions, pushes back constructively, and delivers without close supervision.

• Ability to run multiple concurrent engagements (typically 4–6), track milestones, and report status in a remote, asynchronous environment (Slack, Notion, Google Workspace).

Preferred Experience and Qualifications

• CMMC Certified Assessor (CCA) strongly preferred; CMMC Certified Professional (CCP) at minimum. Lead CCA designation or Registered Practitioner Advanced (RPA) a plus.

• Hands-on implementation experience in both Google Workspace and Microsoft 365 GCC High, including GCC High migrations and Google Workspace configurations built to NIST SP 800-171.

• Depth in Apple Business Manager, Android Enterprise, Microsoft Defender for Endpoint, Microsoft Purview, Microsoft Sentinel, or Google SecOps; CIS Benchmarks or DISA STIG hardening; Windows Server and Active Directory in hybrid environments.

• CUI enclave design and migration: GCC High, Azure Government, AWS GovCloud, or on-prem enclaves, including FedRAMP Moderate equivalency evaluation of cloud service providers and scoping of external service providers.

Travel Expectations/Requirements: 10%–25% (customer kickoffs, on-site readiness reviews, C3PAO assessment weeks)