Implementation Specialist, CMMC

The role

You will lead hands-on CMMC implementation projects for customers, owning the customer experience from kickoff through handoff and readiness milestones. You will coordinate internal teams, partners, and customer stakeholders, and help customers understand and operationalize CMMC requirements.

What you will do

• Lead end-to-end CMMC implementations for new and existing Secureframe customers.
• Translate customer requirements into implementation plans with scope, timeline, milestones, owners, risks, dependencies, and success criteria.
• Help customers understand and operationalize CMMC requirements, including NIST SP 800-171 controls, SSP and POA&M workflows, evidence collection, and audit-readiness preparation.
• Identify where CUI lives across email, file sharing, cloud apps, endpoints, engineering systems, facilities, and third-party providers.
• Coordinate implementation work across Secureframe product configuration, control mapping, evidence automation, policies, and readiness reporting.
• Support secure-environment planning discussions, including identity, endpoint management, logging, network segmentation, and partner-led remediation.
• Work with Sales and Customer Success to improve pre-sale scoping, implementation estimates, and handoff quality.
• Collaborate with CMMC partners, MSPs, consultants, auditors, and C3PAOs within clear role boundaries.
• Deliver live customer training and working sessions on assigning owners, collecting evidence, and remediating gaps.
• Build repeatable implementation assets such as kickoff templates, project plans, RACI models, evidence checklists, and handoff runbooks.

Required qualifications

• 2-5 years of experience in implementation, professional services, customer success, project management, technical consulting, GRC, security compliance, or a similar customer-facing delivery role.
• Strong project-management skills, including managing timelines, dependencies, risks, executive visibility, and cross-functional accountability.
• Technical fluency to discuss identity, endpoints, cloud environments, logging, access control, asset inventory, network boundaries, and secure collaboration.
• Understanding of, or motivation to quickly learn, CMMC, NIST SP 800-171, CUI, FCI, SSPs, POA&Ms, evidence management, and audit readiness.
• Comfort with ambiguity and early-stage operating environments.
• Ability to explain complex compliance and technical concepts in plain language.
• Clear written and live communication, including project plans, status updates, and executive summaries.
• Ability to work with customers from founder-led teams with minimal IT capacity to larger multi-department organizations.
• Resourcefulness with modern tools, including AI.

Nice to have

• Experience with CMMC, NIST SP 800-171, DFARS 252.204-7012, FedRAMP, ITAR, GCC High, Azure Government, AWS GovCloud, or defense-sector customers.
• Experience implementing or administering GRC platforms, compliance automation tools, ticketing systems, identity providers, MDM, EDR, SIEM, or secure enclave environments.
• Experience in professional services, managed services, security consulting, audit readiness, or partner-assisted delivery.
• Certifications such as PMP, CSM, Security+, CISA, CISM, CRISC, CCSK, or equivalent practical experience.
• Experience building implementation playbooks, service packages, or onboarding programs from an early stage.

Benefits

• Industry-competitive salary and equity
• Medical, dental, and vision benefits for you and your dependents
• Flexible time off
• 401(k)
• Paid family leave
• Ground floor opportunity as an early member of the team

Before you apply

• Secureframe is an equal opportunity employer.
• All genuine Secureframe recruiting communication is sent from @secureframe.com email addresses.
• Secureframe never asks job applicants for payments or fees at any stage.

About the company

Secureframe provides cybersecurity compliance solutions that help businesses achieve and maintain compliance standards. The company is backed by investors including Kleiner Perkins, Accomplice, and Gradient Ventures.