CMMC Compliance Lead

Brasfield & Gorrie, LLC; Birmingham (AL); Hybrid; USD 80,000 - 120,000; Full time

Job summary

Brasfield & Gorrie, LLC is seeking a proactive security professional to lead the CMMC program and transition into Facility Security Officer (FSO) as we scale. The hybrid role starts as CMMC Compliance Lead, owning governance, policies, and monitoring under NIST SP 800-171 and CMMC Level 2, with a path to FSO responsibilities including personnel clearances and facility security.

The candidate will partner with Legal, IT, and MSP to ensure controls are implemented and audit-ready, and will grow

Qualifications

• U.S. Citizenship is required due to federal compliance.
• Bachelor’s degree in business, information systems, cybersecurity, or related field preferred.
• Minimum of 3 years in compliance, audit, risk, IT, cybersecurity, or regulated environments.
• Experience supporting documentation control, audit readiness, or compliance tracking.
• Familiarity with CMMC Level 2, NIST SP 800-171, DFARS 252.204-7012 and federal contracting requirements.
• Strong organizational, written and verbal communication skills.

Responsibilities

• Maintain and administer the CMMC assessment inventory log with evidence status and remediation tracking.
• Maintain centralized compliance documentation, trackers, and audit-ready status.
• Monitor deadlines and follow-up actions related to compliance readiness.
• Support internal and external cybersecurity assessments and audits.
• Coordinate collection and organization of required evidence and documentation.
• Review submissions for completeness and alignment with program requirements.
• Track remediation items, action plans, and progress to resolution.
• Prepare and distribute readiness summaries and status updates.
• Review contracts for federal cybersecurity compliance and obligations.
• Escalate gaps or missing documentation to stakeholders.
• Collaborate with IT/Security, Compliance, and Legal on documentation requirements.

Skills

CMMC Level 2

NIST SP 800-171

Audit readiness

Documentation control

Regulatory compliance

Cross-functional collaboration

Education

Bachelor’s degree in business, information systems, cybersecurity, or related field

Tools

Microsoft Office Suite

Excel

Word

Teams

Job description

Responsibilities

Brasfield & Gorrie, a recognized leader in the construction industry and is expanding our federal and defense market sectors. We operate a secure data environment managing Controlled Unclassified Information (CUI) for a workforce of 30-100 personnel. As we expand our footprint, we are preparing to secure our corporate Facility Clearance (FCL) to support classified programs. We are seeking a proactive security professional to lead our current CMMC program and transition into our official Facility Security Officer (FSO) as we scale. In this hybrid role, you will initially serve as our CMMC Compliance Lead, owning the governance, policies, and continuous monitoring required under NIST SP 800-171 and CMMC Level 2. You will partner directly with our Legal Team, Internal IT Team and Outsourced MSP to ensure technical controls are executed properly and maintain an organized, audit-ready program and support ongoing assessment and reporting activities. As the company secures its Facility Clearance, you will transition into the role of Facility Security Officer (FSO), taking ownership of personnel clearances, physical facility security, and government agency liaison duties. Candidates should be comfortable with both phases and prepared to grow into the FSO function.

Responsibilities and Essential Duties include the following (other duties may be assigned):

Compliance Program Administration

• Maintain and administer the CMMC assessment inventory log, including systems, assets, control owners, evidence status, and remediation tracking
• Maintain centralized compliance documentation, evidence inventories, version logs, trackers, and status reports - ensuring everything is complete, accurate, and audit-ready at all times.
• Monitor deadlines, outstanding items, and follow-up actions related to compliance readiness

Assessment & Audit Readiness Support

• Support preparation for internal and external cybersecurity assessments and audits
• Coordinate collection and organization of required evidence and documentation
• Review submissions for completeness, consistency, and alignment with program requirements
• Track remediation items, action plans, and progress through resolution
• Prepare and distribute readiness summaries and status updates

Contract & Regulatory Compliance Support

• Review contracts and client requirements related to federal cybersecurity compliance
• Assist in identifying and tracking obligations associated with CMMC and NIST SP 800-171
• Ensure required compliance documentation is maintained to support contractual obligations
• Escalate gaps, inconsistencies, or missing documentation to appropriate stakeholders

Cross-Functional Coordination

• Partner with IT/Security to maintain accurate system and asset information
• Coordinate with Compliance and Legal/Contracts on documentation requirements and audit readiness
• Support internal stakeholders with compliance documentation requirements and processes
• Schedule and support meetings, working sessions, and follow-up communications

Process Improvement & Training Support

• Assist in developing and maintaining standard operating procedures, templates, and checklists
• Support training efforts for stakeholders responsible for compliance documentation
• Promote consistent documentation practices, version control, and record retention

Reporting & Documentation Management

• Serve as the system of record coordinator for the assessment inventory log
• Validate updates across departments and maintain traceability of compliance records
• Generate regular reports on compliance status, readiness, and outstanding items

FSO Responsibilities: Future State

When Brasfield & Gorrie secures its Facility Clearance, this role will expand to include:

• Personnel clearances, physical facility security, and government agency liaison duties.

Education - Skills - Knowledge - Qualifications & Experience

Education/Qualifications/Experience/Skills:

• U.S. Citizenship is strictly required due to federal compliance and clearance trajectories.
• Bachelor’s degree in business, information systems, cybersecurity, compliance, or related field preferred
• Minimum of 3 years of experience in compliance, audit, risk, IT, cybersecurity, or a regulated program environment
• Experience supporting documentation control, audit readiness, or compliance tracking activities
• Familiarity with CMMC Level 2, NIST SP 800-171, DFARS 252.204-7012 and federal contracting requirements
• Strong organizational skills with attention to detail and ability to manage multiple deadlines
• Strong written and verbal communication skills
• Proficiency in Microsoft Office Suite, including Excel, Word, and Teams
• Ability to learn new systems and manage compliance documentation tools
• Ability to work cross-functionally and maintain confidentiality and professionalism

The above description covers the principal duties and responsibilities of the job. The description shall not, however, be construed as a complete listing of all miscellaneous, incidental, or similar duties which may be required from day-to-day. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.