CMMC Continuous Compliance Analyst

Jobtailor; United States; On-site; USD 85,000 - 120,000; Full time

Job summary

Jobtailor in the United States is seeking a cybersecurity compliance professional to lead CMMC/NIST 800-171 alignment, evidence collection, and remediation coordination across IT and security teams. You will maintain SSPs, policies, and POA&Ms, and perform ongoing reviews to validate control effectiveness.

The role requires strong documentation, collaboration with stakeholders, and clear communication to support audit readiness and executive reporting.

Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Information Systems, Computer Science, or related field.
• 3–6 years of experience in cybersecurity compliance, GRC, IT audit, security operations, infrastructure operations, or related technical security function.
• Working knowledge of CMMC, NIST SP 800-171, or comparable cybersecurity compliance frameworks.
• Ability to interpret security control requirements and translate them into practical validation activities, evidence collection, and remediation recommendations.
• Understanding of core cybersecurity concepts including identity and access management, multifactor authentication, endpoint security, vulnerability management, logging, network security, asset management, backups, change management, and incident response.
• Experience reviewing technical evidence and determining whether security controls are operating effectively.
• Ability to collaborate with technical and business teams to investigate compliance gaps, coordinate remediation activities, and support audit readiness.
• Strong analytical, organizational, documentation, and written communication skills with the ability to manage multiple priorities and deadlines.

Responsibilities

• Review, maintain, and improve CMMC documentation, including the System Security Plan (SSP), policies, procedures, control narratives, evidence repositories, and Plans of Action and Milestones (POA&Ms).
• Perform ongoing compliance reviews against CMMC and NIST SP 800-171 requirements, validating that documented controls align with actual technical and operational implementation.
• Collect, organize, validate, and maintain compliance evidence from systems, logs, tickets, vulnerability reports, access reviews, training records, and other supporting sources to ensure audit readiness.
• Partner with infrastructure, security, system owners, and business stakeholders to validate control implementation, identify compliance gaps, and support remediation efforts.
• Track findings, POA&Ms, remediation activities, control exceptions, and risk acceptance decisions through resolution.
• Review technical configurations and security tooling related to areas such as identity and access management, multifactor authentication, vulnerability management, endpoint protection, logging, configuration management, asset inventory, backups, incident response, and network security.
• Support internal readiness assessments, external CMMC assessments, and continuous monitoring activities by maintaining accurate documentation and repeatable compliance processes.
• Prepare compliance metrics, status reports, dashboards, and executive summaries that communicate compliance posture, audit readiness, remediation progress, and organizational risk.

Skills

GRC experience

Analytical skills

Documentation skills

Education

Bachelor's degree in Cybersecurity, Information Technology, Information Systems, Computer Science, or related field

Job description

Responsibilities

• Review, maintain, and improve CMMC documentation, including the System Security Plan (SSP), policies, procedures, control narratives, evidence repositories, and Plans of Action and Milestones (POA&Ms).
• Perform ongoing compliance reviews against CMMC and NIST SP 800-171 requirements, validating that documented controls align with actual technical and operational implementation.
• Collect, organize, validate, and maintain compliance evidence from systems, logs, tickets, vulnerability reports, access reviews, training records, and other supporting sources to ensure audit readiness.
• Partner with infrastructure, security, system owners, and business stakeholders to validate control implementation, identify compliance gaps, and support remediation efforts.
• Track findings, POA&Ms, remediation activities, control exceptions, and risk acceptance decisions through resolution.
• Review technical configurations and security tooling related to areas such as identity and access management, multifactor authentication, vulnerability management, endpoint protection, logging, configuration management, asset inventory, backups, incident response, and network security.
• Support internal readiness assessments, external CMMC assessments, and continuous monitoring activities by maintaining accurate documentation and repeatable compliance processes.
• Prepare compliance metrics, status reports, dashboards, and executive summaries that communicate compliance posture, audit readiness, remediation progress, and organizational risk.

Requirements

• Bachelor's degree in Cybersecurity, Information Technology, Information Systems, Computer Science, or a related field, or an equivalent combination of education and experience.
• Three to six years of experience supporting cybersecurity compliance, governance, risk and compliance (GRC), IT audit, security operations, infrastructure operations, or a related technical security function.
• Working knowledge of CMMC, NIST SP 800-171, or comparable cybersecurity compliance frameworks.
• Ability to interpret security control requirements and translate them into practical validation activities, evidence collection, and remediation recommendations.
• Understanding of core cybersecurity concepts including identity and access management, multifactor authentication, endpoint security, vulnerability management, logging, network security, asset management, backups, change management, and incident response.
• Experience reviewing technical evidence and determining whether security controls are operating effectively.
• Ability to collaborate with technical and business teams to investigate compliance gaps, coordinate remediation activities, and support audit readiness.
• Strong analytical, organizational, documentation, and written communication skills with the ability to manage multiple priorities and deadlines.