CMMC Compliance Manager

Beryllium InfoSec, Inc.; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Beryllium InfoSec, Inc. seeks a CMMC Compliance Manager to guide Cuick Trac clients through implementing and maintaining customer-responsible controls and preparing them for third‑party assessments.

You will translate the Customer Responsibility Matrix into actionable plans, build required documentation, and keep clients compliant as contracts and regulations evolve. Remote work with travel as needed is possible.

Qualifications

• 2–4 years of customer-facing experience with NIST SP 800-171, NIST SP 800-53, CMMC, and the NIST RMF.
• Knowledge of DoD cybersecurity clauses DFARS 252.204-7012, 252.204-7021, 252.240-7997, and FAR 52.240-93.
• Familiarity with the CMMC program rule (32 CFR Part 170), including scoping, POA&M, and affirmation requirements.
• Experience with POA&M management and developing SSPs/POA&Ms.

Responsibilities

• Walk clients through the Cuick Trac Customer Responsibility Matrix and separate inherited, shared, and customer-responsible controls.
• Create and validate client-specific inheritance and responsibility documentation.
• Provide remediation guidance to implement NIST SP 800-171/CMMC Level 2 controls, including diagrams, data flows, and incident response plans.
• Develop and maintain the SSP and POA&M, tracking closeout within required timeframes.
• Prepare clients for CMMC Level 2 C3PAO assessments and, where applicable, DCMA DIBCAC assessments.
• Assemble evidence packages and coach client personnel for assessor interviews and demonstrations.
• Conduct annual compliance reviews and review government contracts for cybersecurity and export-control requirements.

Skills

NIST SP 800-171

NIST SP 800-53

CMMC

RMF

FAR 52.240-93

CMMC Level 2

Tools

Firewalls

SIEM

Vulnerability management

MFA

Endpoint protection

DLP

Job description

The CMMC Compliance Manager guides Cuick Trac® clients through implementing and maintaining every customer‑responsible control in their environment, and prepares and supports them through third‑party (C3PAO) assessments where required. You will be the client’s trusted advisor from onboarding through certification and beyond: translating the Customer Responsibility Matrix into a practical action plan, building the documentation assessors expect, and keeping clients compliant as their business, contracts, and the regulations evolve. The ideal candidate has hands‑on experience with NIST SP 800-171, CMMC, and the current DFARS cybersecurity clauses as they apply to Controlled Unclassified Information (CUI), Covered Defense Information (CDI), Controlled Technical Information (CTI), and export‑controlled data (ITAR/EAR).

Key Responsibilities

• Walk each client through the Cuick Trac Customer Responsibility Matrix, clearly separating inherited, shared, and customer‑responsible controls.
• Create and validate client‑specific inheritance and responsibility documentation.
• Provide remediation guidance so clients fully implement their customer‑responsible NIST SP 800-171 / CMMC Level 2 requirements, including:
  • Boundary and scoping diagrams (CUI, Security Protection, Contractor Risk Managed, and Out‑of‑Scope assets)
  • Data and user flow diagrams and data management plans
  • Incident response plans and tabletop testing exercises
  • Physical security remediation advisory
  • Policies and procedures, reviewed or written from scratch

  Assessment readiness and documentation

• Perform gap assessments, risk assessments, and implementation reviews against NIST SP 800-171A objectives.
• Develop and maintain the System Security Plan (SSP) and Plan of Action and Milestones (POA&M), including tracking POA&M closeout within required timeframes.
• Advise clients on CMMC status entries and annual affirmations in SPRS.

  Third‑party assessment support

• Prepare clients for CMMC Level 2 C3PAO assessments and, where applicable, DCMA DIBCAC Medium and High assessments.
• Assemble evidence packages and coach client personnel for assessor interviews and demonstrations.
• Support clients during assessments and guide remediation of any findings.

  Ongoing compliance

• Conduct annual compliance reviews to keep clients assessment‑ready between certifications.
• Review government contracts and solicitations for cybersecurity, CUI, and export‑control requirements, recognizing both current and legacy clause numbers.
• Build and manage compliance roadmaps based on existing and emerging cybersecurity standards.
• Administer the Governance, Risk, and Compliance (GRC) tool for assigned clients.
• Other duties as assigned based on business needs.

  Required Skills & Experience

• 2–4 years of customer‑facing experience with NIST SP 800-171, NIST SP 800-53, CMMC, and the NIST Risk Management Framework.
• Working knowledge of the DoD cybersecurity clauses as realigned on February 1, 2026 under the Revolutionary FAR Overhaul class deviations:
  • DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting
  • DFARS 252.204-7021, Contractor Compliance with the CMMC Level Requirements, and provision 252.204-7025, Notice of CMMC Level Requirements
  • DFARS 252.240-7997, NIST SP 800-171 DoD Assessment Requirements (formerly 252.204-7020)
  • FAR 52.240-93, Basic Safeguarding of Covered Contractor Information Systems (formerly 52.204-21)
  • Awareness that legacy contracts may still cite 252.204-7019 and 252.204-7020
• Familiarity with the CMMC program rule (32 CFR Part 170), including scoping, POA&M, and affirmation requirements.
• Experience with firewalls, SIEM, vulnerability management, MFA, endpoint protection, DLP, and other security tools.
• Experience with risk and security assessment processes, and with tracking and remediating findings from audits or assessments.
• POA&M management.
• Knowledge of DoD cybersecurity policy, governance best practices, and emerging trends.
• Working knowledge of operating systems, security applications, and basic network protocols, tools, and infrastructure.
• Strong written and verbal communication; able to explain technical requirements to non-technical business owners.
• Strong project management skills, with the ability to run multiple client engagements at once. This includes planning timelines and milestones, prioritizing competing deadlines, tracking deliverables, and keeping each client informed of status and next steps.
• Consultative client management: delivers difficult findings with tact, builds trust, and handles pushback while keeping the client relationship strong.
• Teaching and coaching: helps client personnel understand and take ownership of their customer‑responsible controls, and prepares them to answer assessor questions on their own.
• Exceptional attention to detail: keeps SSPs, diagrams, evidence, and other documentation accurate and consistent with each other.
• Microsoft Office / Microsoft 365.
• Occasional travel may be required.

Preferred Skills & Experience

• Incident response planning and tabletop exercises: writing and updating incident response plans, and designing and facilitating tabletop exercises that test clients’ detection, escalation, and reporting procedures, including DoD’s 72-hour cyber incident reporting requirement.
• Familiarity with emerging and upcoming compliance requirements, and the ability to help clients prepare for them:
  • NIST SP 800-171 Revision 3
  • The FAR Controlled Unclassified Information (CUI) rule
  • The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)

  Preferred Certifications

  The following are representative of the certifications we value: CMMC Certified Professional (CCP), CMMC Certified Assessor (CCA), CMMC Registered Practitioner (RP / RPA), CISSP, CISM, CISA, ISO/IEC 27001 Lead Auditor, and Microsoft Azure certifications.

Eligibility

Because this position may require access to export-controlled information, candidates must met applicable U.S. person requirements under relevant export-control regulations, including U.S. citizens, lawful permanent residents, and other qualifying protected individuals as defined under 8 U.S.C 1324b (a)(3).

Work Location

This is a remote position.