CMMC Compliance Lead (Remote - US only)

IllTip; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

IllTip is seeking a customer-facing lead to drive CMMC Level 1/2 engagements with federal and commercial clients in the United States. You will own interpretation of NIST SP 800-171, scope assessment boundaries, and documentation from kickoff through C3PAO assessment and sustainment.

Expect 10–25% travel for kickoff, readiness reviews and assessment weeks. You will configure controls hands-on and verify results as an assessor, writing SSPs, policies, and POA&Ms, and coordinating evidence for

Qualifications

• Hands-on experience guiding defense contractors through NIST SP 800-171 or CMMC Level 2.
• Ability to write assessor-ready documentation including SSPs, policies, POA&Ms, and diagrams.
• Direct admin-console experience with GCC High or Google Workspace.
• Endpoint management on Windows and macOS with Intune or Jamf; know SIEM and vulnerability management.

Responsibilities

• Serve as the primary day-to-day contact for assigned customers, leading kickoffs and status updates.
• Define assessment boundaries by tracing FCI/CUI and producing boundary diagrams.
• Write and maintain SSPs, policies, POA&Ms, and evidence libraries; support SPRS submissions.
• Implement controls (identity, MFA, access) in GCC High or Google Workspace tenants.
• Manage endpoint configuration across Windows/macOS with Intune or Jamf; enforce baselines.
• Assist customers through assessment week and sustainment cycles.

Skills

NIST 800-171

CMMC Level 2

Executive communication

Project management

Tools

GCC High

Google Workspace

Intune

Jamf

SIEM

Job description

A US-based company that builds secure software delivery solutions for federal and commercial customers is hiring a customer-facing lead for CMMC Level 1 and Level 2 engagements. The role owns NIST SP 800-171 interpretation, assessment boundary scoping, documentation, and assessment readiness from kickoff through the C3PAO assessment and into ongoing sustainment. The person in this role is expected to configure controls hands-on and to verify results the way an assessor would. Travel of 10%-25% is expected for customer kickoffs, on-site readiness reviews, and assessment weeks.

Responsibilities

• Act as the primary day-to-day contact for assigned customers, running kickoffs, working sessions, and status reporting, and answering CMMC and NIST SP 800-171 questions accurately.
• Scope the assessment boundary by tracing FCI and CUI flows, categorizing assets under the CMMC Level 2 Scoping Guide, and producing boundary, data-flow, and network diagrams.
• Write and maintain the System Security Plan, policies, POA&M, and evidence library; score self-assessments and SPRS submissions under the DoD Assessment Methodology.
• Implement identity, MFA, conditional access, least-privilege, data protection, and encryption controls directly in customer Microsoft 365 GCC High or Google Workspace tenants.
• Manage endpoint configuration across Windows and macOS with Microsoft Intune or Jamf, including disk encryption, compliance policies, patching, and hardening baselines.
• Assess the finished environment against the CMMC Level 2 Assessment Guide, close gaps before the assessor arrives, and support customers through assessment week and sustainment cycles.

Requirements

• Hands-on experience taking defense contractors through NIST SP 800-171 or CMMC Level 2 from scoping through a C3PAO or DIBCAC assessment, in a consultant, assessor, or internal lead role.
• Proven ability to write assessor-ready documentation, including SSPs at the assessment-objective level, policies, POA&Ms, and diagrams.
• Direct admin-console experience with GCC High (Entra ID, Intune, Purview, Defender) or Google Workspace (Admin console, Cloud Identity, context-aware access).
• Endpoint management experience on Windows and macOS with Intune or Jamf, plus working knowledge of SIEM/log platforms, vulnerability management, backup, and network perimeter controls.
• Strong plain-language communication with executives and IT staff, and ability to manage 4-6 concurrent engagements in an asynchronous remote setting.
• Must be located in the United States. CMMC Certified Professional (CCP) or Certified Assessor (CCA) credentials are strongly preferred.

Applicants must be based in: United States.