CMMC Compliance Manager

Beryllium InfoSec; Oregon; Híbrido; USD 110.000 - 150.000; Jornada completa

Descripción de la vacante

Beryllium InfoSec, Inc. seeks a CMMC Compliance Manager to guide Cuick Trac clients through implementing customer-responsible controls and preparing for CMMC Level 2 assessments.

You will translate the Customer Responsibility Matrix into actionable plans, build required documentation, and keep clients compliant as regulations evolve. Responsibilities include gap/risk assessments, SSP/POA&M maintenance, SPRS affirmations, evidence packages, and governance coordination.

Formación

• 2-4 years of customer-facing experience with NIST SP 800-171, 800-53, CMMC, and the NIST Risk Management Framework.
• Working knowledge of the DoD cybersecurity clauses as realigned in 2026 under the Revolutionary FAR Overhaul class deviations.
• Familiarity with the CMMC program rule (32 CFR Part 170), including scoping, POA&M, and affirmation requirements.
• Experience with risk and security assessment processes, and with tracking and remediating findings from audits or assessments.
• POA&M management and strong written/verbal communication.
• Occasional travel may be required.

Responsabilidades

• Guide clients through the Cuick Trac Customer Responsibility Matrix, clearly separating inherited, shared, and customer-responsible controls.
• Create and validate client-specific inheritance and responsibility documentation.
• Provide remediation guidance to fully implement customer-responsible controls and related diagrams, plans, and policies.
• Perform gap assessments, risk assessments, and implementation reviews against NIST SP 800-171A.
• Develop and maintain the SSP and POA&M, tracking closeout timelines.
• Advise on CMMC status entries and annual affirmations in SPRS.
• Prepare clients for CMMC Level 2 C3PAO assessments and related evaluations.
• Assemble evidence packages and coach client personnel for assessor interviews.
• Support clients during assessments and guide remediation of findings.
• Conduct annual compliance reviews and build roadmaps based on standards.
• Administer the GRC tool for assigned clients.
• Other duties as assigned.

Conocimientos

NIST SP 800-171

NIST SP 800-53

CMMC

NIST RMF

DoD cybersecurity

Incident response

POA&M management

GRC tools

Communication

Project management

Travel readiness

Herramientas

Firewalls

SIEM

Vulnerability management

MFA

Endpoint protection

DLP

Descripción del empleo

The CMMC Compliance Manager guides Cuick Trac® clients through implementing and maintaining every customer-responsible control in their environment, and prepares and supports them through third-party (C3PAO) assessments where required. You will be the client's trusted advisor from onboarding through certification and beyond: translating the Customer Responsibility Matrix into a practical action plan, building the documentation assessors expect, and keeping clients compliant as their business, contracts, and the regulations evolve.

Key Responsibilities

Customer-responsible control implementation

• Walk each client through the Cuick Trac Customer Responsibility Matrix, clearly separating inherited, shared, and customer-responsible controls.
• Create and validate client-specific inheritance and responsibility documentation.
• Provide remediation guidance so clients fully implement their customer-responsible NIST SP 800-171 / CMMC Level 2 requirements, including:
  • Boundary and scoping diagrams (CUI, Security Protection, Contractor Risk Managed, and Out-of-Scope assets)
  • Data and user flow diagrams and data management plans
  • Incident response plans and tabletop testing exercises
  • Physical security remediation advisory
  • Policies and procedures, reviewed or written from scratch

Assessment readiness and documentation

• Perform gap assessments, risk assessments, and implementation reviews against NIST SP 800-171A objectives.
• Develop and maintain the System Security Plan (SSP) and Plan of Action and Milestones (POA&M), including tracking POA&M closeout within required timeframes.
• Advise clients on CMMC status entries and annual affirmations in SPRS.

Third-party assessment support

• Prepare clients for CMMC Level 2 C3PAO assessments and, where applicable, DCMA DIBCAC Medium and High assessments.
• Assemble evidence packages and coach client personnel for assessor interviews and demonstrations.
• Support clients during assessments and guide remediation of any findings.

Ongoing compliance

• Conduct annual compliance reviews to keep clients assessment-ready between certifications.
• Review government contracts and solicitations for cybersecurity, CUI, and export-control requirements, recognizing both current and legacy clause numbers.
• Build and manage compliance roadmaps based on existing and emerging cybersecurity standards.
• Administer the Governance, Risk, and Compliance (GRC) tool for assigned clients.
• Other duties as assigned based on business needs.

Required Skills & Experience

• 2-4 years of customer-facing experience with NIST SP 800-171, NIST SP 800-53, CMMC, and the NIST Risk Management Framework.
• Working knowledge of the DoD cybersecurity clauses as realigned on February 1, 2026 under the Revolutionary FAR Overhaul class deviations:
  • DFARS , Safeguarding Covered Defense Information and Cyber Incident Reporting
  • DFARS , Contractor Compliance with the CMMC Level Requirements, and provision , Notice of CMMC Level Requirements
  • DFARS , NIST SP 800-171 DoD Assessment Requirements (formerly )
  • FAR 52.240-93, Basic Safeguarding of Covered Contractor Information Systems (formerly 52.204-21)
  • Awareness that legacy contracts may still cite and
• Familiarity with the CMMC program rule (32 CFR Part 170), including scoping, POA&M, and affirmation requirements.
• Experience with firewalls, SIEM, vulnerability management, MFA, endpoint protection, DLP, and other security tools.
• Experience with risk and security assessment processes, and with tracking and remediating findings from audits or assessments.
• POA&M management.
• Knowledge of DoD cybersecurity policy, governance best practices, and emerging trends.
• Working knowledge of operating systems, security applications, and basic network protocols, tools, and infrastructure.
• Strong written and verbal communication; able to explain technical requirements to non-technical business owners.
• Strong project management skills, with the ability to run multiple client engagements at once. This includes planning timelines and milestones, prioritizing competing deadlines, tracking deliverables, and keeping each client informed of status and next steps.
• Consultative client management: delivers difficult findings with tact, builds trust, and handles pushback while keeping the client relationship strong.
• Teaching and coaching: helps client personnel understand and take ownership of their customer-responsible controls, and prepares them to answer assessor questions on their own.
• Exceptional attention to detail: keeps SSPs, diagrams, evidence, and other documentation accurate and consistent with each other.
• Microsoft Office / Microsoft 365.
• Occasional travel may be required.

Preferred Skills & Experience

• Incident response planning and tabletop exercises: writing and updating incident response plans, and designing and facilitating tabletop exercises that test clients' detection, escalation, and reporting procedures, including DoD's 72-hour cyber incident reporting requirement.
• Familiarity with emerging and upcoming compliance requirements, and the ability to help clients prepare for them:
  • NIST SP 800-171 Revision 3
  • The FAR Controlled Unclassified Information (CUI) rule
  • The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)

Preferred Certifications

The following are representative of the certifications we value: CMMC Certified Professional (CCP), CMMC Certified Assessor (CCA), CMMC Registered Practitioner (RP / RPA), CISSP, CISM, CISA, ISO/IEC 27001 Lead Auditor, and Microsoft Azure certifications.

Eligibility

Because this position may require access to export-controlled information, candidates must met applicable U.S. person requirements under relevant export-control regulations, including U.S. citizens, lawful permanent residents, and other qualifying protected individuals as defined under 8 U.S.C 1324b (a)(3).

Work Location

This is a remote position.