CMMC Compliance Analyst

Alvarez Technology Group; Salinas (CA); On-site; USD 41,000 - 55,000; Full time

Job summary

Alvarez Technology Group (ATG) is seeking a Compliance Analyst to deliver client-facing cybersecurity compliance, risk management, and governance services. This position will work directly with customers to assess risk, evaluate compliance, develop policies and operating procedures, organize evidence, document findings, and coordinate remediation activities through completion.

The ideal candidate combines strong client communication and project-management skills with practical cybersecurity

Qualifications

• Experience in cybersecurity governance, risk management, compliance, IT audit, security assessment, or related discipline.
• Experience conducting cybersecurity risk assessments or compliance assessments.
• Experience reviewing controls and evidence against defined requirements.
• Experience developing cybersecurity policies, standards, operating procedures, and control documentation.
• Working knowledge of NIST SP 800-171, CMMC, NIST CSF, CIS Controls, GLBA, FFIEC guidance, or comparable frameworks.
• Experience documenting findings, risks, exceptions, remediation activities, and control status within a GRC process or platform.
• Strong client-facing communication, facilitation, presentation, and technical writing skills.
• Ability to conduct structured interviews with technical and nontechnical stakeholders.
• Ability to coordinate multiple customer projects, assessments, deliverables, and deadlines.
• Strong organization, follow-through, professional judgment, and attention to evidence quality.
• Working knowledge of identity and access management, endpoint security, vulnerability management, logging and SIEM, network security, cloud security, Microsoft 365, and data protection.

Responsibilities

• Deliver client-facing cybersecurity compliance, risk management, and governance services.
• Interview stakeholders, review evidence, identify control gaps, and document risk.
• Translate complex requirements into clear, actionable recommendations.
• Maintain internal processes, templates, GRC data, evidence standards, and workflows.

Skills

Cybersecurity governance

Risk management

Compliance

IT audit

Security assessment

GRC processes

Policy development

Stakeholder interviewing

Project management

Documentation skills

Identity management

Education

Bachelor's degree preferred

CISA

CRISC

CISM

CISSP

CCSP

CompTIA Security+

CMMC / Cyber-AB credentials

Microsoft Security certifications

Tools

Microsoft 365

Entra ID

Intune

Defender

Sentinel

Purview

Azure

Job description

Alvarez Technology Group (ATG) is a managed technology and cybersecurity services company. ATG also assists organizations with regulatory and cybersecurity compliance, including CMMC readiness and pre-assessment services for companies working within the Defense Industrial Base.

ATG is seeking a Compliance Analyst to deliver client-facing cybersecurity compliance, risk management, and governance services. This position will work directly with customers to assess risk, evaluate compliance, develop policies and operating procedures, organize evidence, document findings, and coordinate remediation activities through completion. The ideal candidate combines strong client communication and project-management skills with practical cybersecurity knowledge and a thorough understanding of governance, risk, and compliance. This individual will interview technical and business stakeholders, review evidence, identify control gaps, document risk, and translate complex requirements into clear, actionable recommendations. The Compliance Analyst will also maintain the internal processes, documentation, templates, GRC data, evidence standards, and workflows used to consistently operate and improve the compliance program.

Required Qualifications

• Experience in cybersecurity governance, risk management, compliance, IT audit, security assessment, or a related discipline.
• Demonstrated experience conducting cybersecurity risk assessments or compliance assessments.
• Experience reviewing controls and supporting evidence against defined requirements.
• Experience developing cybersecurity policies, standards, operating procedures, and control documentation.
• Working knowledge of NIST SP 800-171, CMMC, NIST CSF, CIS Controls, GLBA, FFIEC guidance, or comparable frameworks.
• Experience documenting findings, risks, exceptions, remediation activities, and control status within a GRC process or platform.
• Strong client-facing communication, facilitation, presentation, and technical writing skills.
• Ability to conduct structured interviews with technical and nontechnical stakeholders.
• Ability to coordinate multiple customer projects, assessments, deliverables, and deadlines.
• Strong organization, follow-through, professional judgment, and attention to evidence quality.
• Working knowledge of identity and access management, endpoint security, vulnerability management, logging and SIEM, network security, cloud security, Microsoft 365, and data protection.

Preferred Qualifications

• Experience within an MSP, MSSP, consulting, audit, or professional-services environment.
• Experience working directly with regulated customers and executive stakeholders.
• Experience conducting CMMC or NIST SP 800-171 readiness assessments.
• Experience supporting financial institutions subject to GLBA or FFIEC expectations.
• Experience preparing organizations for third-party audits or regulatory examinations.
• Experience with GRC platforms used to manage controls, risks, evidence, findings, and remediation.
• Familiarity with Microsoft 365, Entra ID, Intune, Defender, Sentinel, Purview, and Azure from a governance and compliance perspective.
• Experience coordinating technical remediation projects with infrastructure, cloud, and security engineering teams.

Education & Certifications

A bachelor's degree in cybersecurity, information technology, information systems, business, risk management, or a related discipline is preferred. Equivalent relevant professional experience should also be considered. Relevant certifications may include:

• CISA - Certified Information Systems Auditor
• CRISC - Certified in Risk and Information Systems Control
• CISM - Certified Information Security Manager
• CISSP - Certified Information Systems Security Professional
• CCSP - Certified Cloud Security Professional
• CompTIA Security+
• CMMC or Cyber-AB ecosystem credentials
• Microsoft Security, Compliance, and Identity certifications Demonstrated assessment capability, client-facing experience, and practical understanding of control implementation are valued alongside formal certifications.

Compensation is commensurate with experience, capabilities, and contribution to the company's success, and is negotiated individually. This is an hourly, NON-EXEMPT position. Wage range $30/hr to $40/hr.

Applicants are required to submit to background check. Applicants must also have valid driver's license and proof of auto insurance.