CMMC Compliance Manager

Beryllium InfoSec, Inc.; Dallas (TX); Remote; USD 100,000 - 170,000; Full time

Job summary

Beryllium InfoSec, Inc. seeks a remote CMMC Compliance Manager to guide clients through NIST SP 800-171 and CMMC Level 2 readiness, including creating action plans, documentation, and evidence packages for C3PAO assessments.

You will lead gap assessments, risk assessments, and maintain SSPs and POA&Ms while advising on SPRS entries and annual affirmations. Remote role with travel as needed.

Qualifications

• Hands-on experience with NIST SP 800-171, NIST SP 800-53, CMMC and RMF processes.
• Experience implementing and guiding customers through DFARS/NIST-based clauses in DoD contracts.
• Ability to develop SSPs/POA&Ms and track remediation.
• Proven ability to prepare clients for CMMC Level 2 C3PAO assessments and interviews.
• Strong communication, project management, and stakeholder management skills.

Responsibilities

• Guide Cuick Trac clients through the Customer Responsibility Matrix, documenting inheritance of controls.
• Create and validate client-specific inheritance documentation and remediation plans.
• Develop and maintain SSP and POA&M with timely closeout tracking.

Skills

NIST SP 800-171

NIST SP 800-53

CMMC

RMF

DFARS

CMMC Level 2

DoD clauses

SIEM

MFA

POA&M management

Tools

Microsoft Office 365

GRC tool

Documentation tooling

Job description

The CMMC Compliance Manager guides Cuick Trac® clients through implementing and maintaining every customer‑responsible control in their environment, and prepares and supports them through third‑party (C3PAO) assessments where required. You will be the client's trusted advisor from onboarding through certification and beyond: translating the Customer Responsibility Matrix into a practical action plan, building the documentation assessors expect, and keeping clients compliant as their business, contracts, and the regulations evolve.

The ideal candidate has hands‑on experience with NIST SP 800-171, CMMC, and the current DFARS cybersecurity clauses as they apply to Controlled Unclassified Information (CUI), Covered Defense Information (CDI), Controlled Technical Information (CTI), and export‑controlled data (ITAR/EAR).

Key Responsibilities

Customer‑responsible control implementation

• Walk each client through the Cuick Trac Customer Responsibility Matrix, clearly separating inherited, shared, and customer‑responsible controls.
• Create and validate client‑specific inheritance and responsibility documentation.
• Provide remediation guidance so clients fully implement their customer‑responsible NIST SP 800-171 / CMMC Level 2 requirements, including:
  • Boundary and scoping diagrams (CUI, Security Protection, Contractor Risk Managed, and Out‑of‑Scope assets)
  • Data and user flow diagrams and data management plans
  • Incident response plans and tabletop testing exercises
  • Physical security remediation advisory
  • Policies and procedures, reviewed or written from scratch

Assessment readiness and documentation

• Perform gap assessments, risk assessments, and implementation reviews against NIST SP 800-171A objectives.
• Develop and maintain the System Security Plan (SSP) and Plan of Action and Milestones (POA&M), including tracking POA&M closeout within required timeframes.
• Advise clients on CMMC status entries and annual affirmations in SPRS.

Third‑party assessment support

• Prepare clients for CMMC Level 2 C3PAO assessments and, where applicable, DCMA DIBCAC Medium and High assessments.
• Assemble evidence packages and coach client personnel for assessor interviews and demonstrations.
• Support clients during assessments and guide remediation of any findings.

Ongoing compliance

• Conduct annual compliance reviews to keep clients assessment‑ready between certifications.
• Review government contracts and solicitations for cybersecurity, CUI, and export‑control requirements, recognizing both current and legacy clause numbers.
• Build and manage compliance roadmaps based on existing and emerging cybersecurity standards.
• Administer the Governance, Risk, and Compliance (GRC) tool for assigned clients.
• Other duties as assigned based on business needs.

Required Skills & Experience

• 2-4 years of customer‑facing experience with NIST SP 800-171, NIST SP 800-53, CMMC, and the NIST Risk Management Framework.
• Working knowledge of the DoD cybersecurity clauses as realigned on February 1, 2026 under the Revolutionary FAR Overhaul class deviations:
  • DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting
  • DFARS 252.204-7021, Contractor Compliance with the CMMC Level Requirements, and provision 252.204-7025, Notice of CMMC Level Requirements
  • DFARS 252.240-7997, NIST SP 800-171 DoD Assessment Requirements (formerly 252.204-7020)
  • FAR 52.240-93, Basic Safeguarding of Covered Contractor Information Systems (formerly 52.204-21)
  • Awareness that legacy contracts may still cite 252.204-7019 and 252.204-7020
• Familiarity with the CMMC program rule (32 CFR Part 170), including scoping, POA&M, and affirmation requirements.
• Experience with firewalls, SIEM, vulnerability management, MFA, endpoint protection, DLP, and other security tools.
• Experience with risk and security assessment processes, and with tracking and remediating findings from audits or assessments.
• POA&M management.
• Knowledge of DoD cybersecurity policy, governance best practices, and emerging trends.
• Working knowledge of operating systems, security applications, and basic network protocols, tools, and infrastructure.
• Strong written and verbal communication; able to explain technical requirements to non‑technical business owners.
• Strong project management skills, with the ability to run multiple client engagements at once. This includes planning timelines and milestones, prioritizing competing deadlines, tracking deliverables, and keeping each client informed of status and next steps.
• Consultative client management: delivers difficult findings with tact, builds trust, and handles pushback while keeping the client relationship strong.
• Teaching and coaching: helps client personnel understand and take ownership of their customer‑responsible controls, and prepares them to answer assessor questions on their own.
• Exceptional attention to detail: keeps SSPs, diagrams, evidence, and other documentation accurate and consistent with each other.
• Microsoft Office / Microsoft 365.
• Occasional travel may be required.

Preferred Skills & Experience

• Incident response planning and tabletop exercises: writing and updating incident response plans, and designing and facilitating tabletop exercises that test clients' detection, escalation, and reporting procedures, including DoD's 72‑hour cyber incident reporting requirement.
• Familiarity with emerging and upcoming compliance requirements, and the ability to help clients prepare for them:
  • NIST SP 800-171 Revision 3
  • The FAR Controlled Unclassified Information (CUI) rule
  • The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)

Preferred Certifications

The following are representative of the certifications we value: CMMC Certified Professional (CCP), CMMC Certified Assessor (CCA), CMMC Registered Practitioner (RP / RPA), CISSP, CISM, CISA, ISO/IEC 27001 Lead Auditor, and Microsoft Azure certifications.

Eligibility

Because this position may require access to export‑controlled information, candidates must met applicable U.S. person requirements under relevant export‑control regulations, including U.S. citizens, lawful permanent residents, and other qualifying protected individuals as defined under 8 U.S.C 1324b (a)(3).

Work Location

This is a remote position.