Compliance Lead - CMMC (NIST SP 800-171)

The role

The Compliance Lead serves as the customer-facing lead for CMMC Level 1 and Level 2 engagements. This person owns NIST SP 800-171 interpretation, scoping, documentation, and assessment readiness from kickoff through sustainment.

What you will do

• Serve as the primary point of contact for assigned customers.
• Scope the CMMC assessment boundary and produce diagrams.
• Lead engagements through the standard delivery process.
• Author and maintain the System Security Plan, policies, procedures, POA&M, and evidence library.
• Implement technical controls hands-on in customer tenants.
• Stand up and operate endpoint management across Windows, macOS, iOS, and Android.
• Build the logging and monitoring stack.
• Assess the finished environment against the CMMC Level 2 Assessment Guide.
• Prepare customers for C3PAO assessments and support them during assessment week.
• Run sustainment for customers including continuous monitoring and annual affirmations.

Required qualifications

• Experience taking defense contractors through NIST SP 800-171 / CMMC Level 2 end to end.
• Led at least one organization through a successful C3PAO or DIBCAC assessment as the consultant, assessor, or internal compliance lead.
• Ability to write System Security Plans, policies, procedures, POA&Ms, and diagrams.
• Hands-on experience implementing NIST SP 800-171 technical controls in Microsoft 365 GCC High or Google Workspace.
• Endpoint management experience with Microsoft Intune or Jamf across Windows and macOS.
• Experience centralizing audit logs and alerts in a SIEM or log platform.
• Working knowledge of networking and perimeter controls.
• Ability to run multiple concurrent engagements in a remote, asynchronous environment.

Nice to have

• CMMC Certified Assessor (CCA) strongly preferred
• CMMC Certified Professional (CCP) at minimum
• Lead CCA designation or Registered Practitioner Advanced (RPA) a plus
• Hands-on implementation experience in both Google Workspace and Microsoft 365 GCC High
• Depth in Apple Business Manager, Android Enterprise, Microsoft Defender for Endpoint, Microsoft Purview, Microsoft Sentinel, or Google SecOps
• CIS Benchmarks or DISA STIG hardening
• Windows Server and Active Directory in hybrid environments
• CUI enclave design and migration

Benefits

• Medical/Dental/Vision
• Premiums are 100% Company Paid
• Health Savings Account
• Life Insurance
• Disability Insurance
• 401k Retirement Plan
• Company Stock Options
• Home Office Budget
• Flexible Time Off (FTO)
• All Federal Holidays
• One week for Thanksgiving
• Two weeks for Christmas and New Year’s

About the company

Defense Unicorns delivers mission value by streamlining software delivery so our customers can focus on the most important challenges. They create and deliver secure solutions for continuous software integration and delivery.