CMMC & NIST GRC Consultant (Remote)

Hotman Group; Fort Worth (TX); Hybrid; USD 90,000 - 140,000; Full time

Job summary

Hotman Group is a boutique cybersecurity and GRC consulting firm delivering federal compliance solutions across CMMC, NIST 800-171, and FedRAMP.

We are seeking a mid-level CMMC and NIST practitioner to join remote contract work, contributing from day one with minimal supervision.

You will develop SSPs, support readiness activities, and collaborate with clients to produce clear, audit-ready documentation.

Qualifications

• 3–5 years of relevant GRC or cybersecurity compliance consulting experience.
• Hands-on CMMC work required.
• Experience developing SSPs and evidence collection.
• Familiarity with NIST SP 800-171/800-53 and FedRAMP.
• Strong writing and client-facing documentation.
• Ability to work independently with minimal ramp-up.
• Active certifications like CCP, CCA, CISSP, CISM, or CISA preferred.

Responsibilities

• Support CMMC readiness, implementation, and documentation.
• Develop and maintain System Security Plans.
• Assist with NIST SP 800-171, 800-53, and FedRAMP deliverables.
• Gather evidence supporting control implementation.
• Define CUI scoping, enclave design, and boundaries.
• Draft control narratives, policies, and procedures.
• Identify gaps and support POA&Ms.
• Collaborate with client stakeholders to move deliverables.
• Contribute to readiness for assessments and audits.
• Participate in peer reviews of deliverables.
• Hands-on remote delivery from day one.

Skills

GRC experience

CMMC hands-on

SSP development

NIST SP 800-171/800-53

Policy documentation

Client communication

Job description

Hotman Group is a boutique cybersecurity and GRC consulting firm delivering federal compliance solutions across CMMC, NIST 800-171, and FedRAMP.

We are seeking a mid-level CMMC and NIST practitioner to join remote contract work, contributing from day one with minimal supervision.

You will develop SSPs, support readiness activities, and collaborate with clients to produce clear, audit-ready documentation.