Compliance Lead – CMMC, NIST SP 800-171

Job not on LinkedIn

🔥 39 minutes ago

🇺🇸 United States – Remote

💵 $123.3k - $166.8k / year

⏰ Full Time

🟠 Senior

🚔 Compliance

👻 Ghost score 15%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Defense Unicorns

WebsiteLinkedInAll Job Openings

51 - 200 employees

💼 Consulting

📦 Logistics

🎖️ Defense

💰 Seed Round on 2022-10

Consulting • Logistics • Defense

Defense Unicorns is a cutting-edge technology company focused on transforming the way the U. S. Department of Defense (DoD) procures and deploys mission-critical software capabilities. Through its Airgap App Store and Unicorn Delivery Service (UDS), Defense Unicorns offers a centralized marketplace of trusted, pre-approved applications designed for rapid, secure, and compliant deployments in the most secure and complex DoD environments. The company emphasizes speed and reliability in software delivery, catering to various missions across domains such as Army, Navy, Air Force, and Space Force. Defense Unicorns meets the unique challenges of DevSecOps for defense systems, ensuring operational adaptability and security in mission-critical software deployments.

📋 Description

• Serve as the primary customer contact throughout each engagement, including kickoff, working sessions, status reporting, and answering CMMC and NIST SP 800-171 questions • Scope CMMC assessment boundaries by tracing FCI and CUI flows, categorizing assets, and producing boundary, data-flow, and network diagrams • Lead engagements from intake through assessor-ready package while enforcing stage gates and evidence standards • Author and maintain System Security Plans, policies, procedures, POA&Ms, and evidence libraries • Score self-assessments and SPRS submissions under the DoD Assessment Methodology and 32 CFR Part 170 • Implement identity, MFA, conditional access, least privilege, privileged-account separation, data protection, FIPS-validated encryption, and configuration baselines in customer tenants • Operate endpoint management across Windows, macOS, iOS, and Android using Microsoft Intune and Jamf • Build and operate centralized audit logging, SIEM alerting, log retention and review, vulnerability scanning, remediation tracking, and backup/recovery verification • Assess environments against the CMMC Level 2 Assessment Guide using examine, interview, and test methods • Run pre-assessment readiness reviews and close gaps before C3PAO assessments • Prepare customers for and support them during C3PAO assessments, including evidence presentation, interview coaching, assessor responses, and POA&M closeout • Run ongoing sustainment through continuous monitoring, change reviews, annual affirmations, and reassessment readiness • Improve compliance delivery through templates, checklists, automation, and contributions to internal AI tooling

🎯 Requirements

• Experience taking defense contractors through NIST SP 800-171 / CMMC Level 2 engagements end to end, including personally leading at least one successful C3PAO or DIBCAC assessment • Ability to write assessor-ready System Security Plans at the assessment-objective level, policies and procedures, POA&Ms, and data-flow and network diagrams • Hands-on implementation of NIST SP 800-171 technical controls in Microsoft 365 GCC High or Google Workspace • Endpoint management experience across Windows and macOS; iOS and Android experience is a plus • Experience with Microsoft Intune or Jamf, including enrollment, compliance and configuration policies, disk encryption, patching, and hardening baselines • Experience centralizing audit logs and alerts in a SIEM or log platform such as Microsoft Sentinel, Google SecOps, or Splunk • Experience operating vulnerability scanning, patch management, and backup • Working knowledge of firewalls, VPN, secure remote access, segmentation, DNS, and wireless networking • Customer-facing leadership, meeting facilitation, plain-language explanation of requirements, decision documentation, and independent delivery • Ability to run 4–6 concurrent engagements and report status in a remote, asynchronous environment using Slack, Notion, and Google Workspace • CMMC Certified Assessor (CCA) strongly preferred; CMMC Certified Professional (CCP) at minimum • Lead CCA designation or Registered Practitioner Advanced (RPA) is a plus • Experience with both Google Workspace and Microsoft 365 GCC High, including GCC High migrations and NIST SP 800-171 configurations • Experience with Apple Business Manager, Android Enterprise, Microsoft Defender for Endpoint, Microsoft Purview, Microsoft Sentinel, Google SecOps, CIS Benchmarks, DISA STIG hardening, Windows Server, and Active Directory is preferred • Experience with CUI enclave design and migration, GCC High, Azure Government, AWS GovCloud, on-premises enclaves, FedRAMP Moderate equivalency evaluation, and external service-provider scoping is preferred • Travel requirement of 10%–25% for customer kickoffs, on-site readiness reviews, and C3PAO assessment weeks

🏖️ Benefits

• Medical, dental, and vision insurance • Company-paid premiums at 100% • Health Savings Account • Life insurance • Disability insurance • 401(k) retirement plan • Company stock options • Home office budget • Flexible Time Off (FTO) • Federal holidays • One week off for Thanksgiving • Two weeks off for Christmas and New Year's • Paid parental leave • Reimbursement for approved trainings and subscriptions • Conferences, including travel, lodging, and fees

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume