Compliance Lead - CMMC (NIST SP 800-171)

Job description

Role Description We are seeking a CMMC Compliance Lead to join Commercial Cyber Operations. This person is the customer-facing lead for CMMC Level 1 and Level 2 engagements and owns NIST SP 800-171 interpretation, scoping, documentation, and assessment readiness from kickoff through the C3PAO assessment and into sustainment. Compliance Lead decides what the systems must satisfy, can configure the controls personally in Google Workspace or Microsoft 365 GCC High, writes the record that proves it, and verifies the result the way an assessor would. This is not a coordination role. The Compliance Lead scopes the assessment boundary, authors the System Security Plan and supporting documentation, directs and where needed performs control implementation, assesses the finished environment against the CMMC Level 2 Assessment Guide, and stands next to the customer during the assessment. They are the day-to-day point of contact for their assigned customers and answer CMMC questions with authority and in plain terms. Customer environments vary: Windows and macOS fleets, GCC High and Google Workspace tenants, Jamf and Intune, cloud and on-prem enclaves. This person has to be versatile enough to work in all of them. Responsibilities The listed responsibilities are not exhaustive and additional responsibilities may be assigned based on the evolving needs of the organization. We are seeking a dynamic individual who is able to adapt and take on new responsibilities as they arise. Serve as the primary point of contact for assigned customers for the life of the engagement: run kickoff, working sessions, and status reporting; answer CMMC and NIST SP 800-171 questions directly and accurately without escalation. Scope the CMMC assessment boundary: trace FCI and CUI flows, categorize assets per the CMMC Level 2 Scoping Guide (CUI, Security Protection, Contractor Risk Managed, Specialized, Out of Scope), and produce the boundary, data-flow, and network diagrams. Lead each engagement through the standard delivery process from intake to assessor-ready package, holding the stage gates and evidence standards. Author and maintain the System Security Plan, policies and procedures, POA&M, and evidence library at the assessment-objective level; score self-assessments and SPRS submissions under the DoD Assessment Methodology and 32 CFR Part 170. Implement the technical controls hands-on in…