Compliance Analyst/Internal Auditor

NMR Consulting; Huntsville (AL); On-site; USD 90,000 - 125,000; Full time

Job summary

NMR Consulting in Huntsville, AL seeks an Internal Auditor and Compliance Specialist to manage and improve corporate compliance frameworks. This role leads internal audits for ISO standards, CMMC, CMMI, and contract documentation, ensuring alignment with client contracts and defense requirements.

The position requires 3–5+ years in auditing/compliance, experience with CMMC/NIST/ISO, and the ability to obtain a U.S. security clearance. Collaboration with auditors and vendors is essential.

Qualifications

• Bachelor's degree in information technology, cybersecurity, business administration, or related field required.
• 3–5+ years of experience in internal auditing, compliance management, quality assurance, or similar role.
• Experience supporting or managing CMMC, NIST SP 800-171, ISO 9001/20000/27001, and CMMI implementations.

Responsibilities

• Plan and execute internal audits against CMMC Level 2, NIST SP 800-171, ISO standards, and CMMI models.
• Identify gaps relative to contractual obligations and regulatory requirements.
• Develop, coordinate, and monitor corrective action plans and ensure closure.
• Write, revise, and standardize internal policies, processes, and SOPs.
• Maintain master documentation library and ensure current versions in use.
• Map client/contract requirements to corporate policies and workflows.
• Review contracts to identify regulatory, quality, and cybersecurity requirements.
• Coordinate with external auditors, registrars, and government assessors.

Skills

Security+

IT systems knowledge

Cybersecurity controls

Data protection

Supply chain risk mgmt

Technical writing

Communication

Education

Bachelor's degree in information technology

Bachelor's degree in cybersecurity

Bachelor's degree in business administration

Job description

Job Summary

We are seeking an Internal Auditor and Compliance Specialist to manage, evaluate, and improve our corporate compliance frameworks. This role leads internal audits of ISO standards, CMMC requirements, CMMI models, and contractual documentation. The position ensures that internal policies, procedures, and evidence align with client contracts, defense requirements, and applicable quality and cybersecurity standards.

Key Responsibilities

Compliance Auditing and Assessment

• Framework Auditing: Plan and execute internal audits against CMMC Level 2, NIST800-171 ISO standards such as ISO 9001, ISO 20000, and ISO 27001, and CMMI Development and Services models.
• Gap Analysis: Identify operational, quality, and security gaps relative to current contractual and regulatory obligations.
• Remediation Tracking: Develop, coordinate, and monitor corrective action plans to address audit findings and verify closure.

Policy and Procedure Management

• Documentation Development: Write, revise, and standardize internal policies, processes, and standard operating procedures.
• Version Control: Maintain the master documentation library and ensure operational teams use approved, current versions.
• Policy Alignment: Map client and contract requirements to corporate policies, controls, and operational workflows.

Contractual and External Audit Support

• Contract Review: Review contracts to identify regulatory, quality, and cybersecurity requirements.
• External Liaison: Serve as the primary point of contact for external auditors, registrars, and government assessors.
• Evidence Collection: Gather, organize, validate, and present the evidence and artifacts required for certification and formal assessments.

Quality Management and Organizational Support

• Quality Management Program: Operate, maintain, and continually improve the corporate quality management program and related systems.
• Briefings and Meetings: Prepare and deliver briefings, participate in quality-management meetings, and communicate system status, requirements, risks, and planned actions.
• Training and Adoption: Provide quality- and compliance-related training to headquarters staff so employees understand applicable requirements and follow company policies and procedures. Participate in tabletop exercises to gain knowledge and best practices that can be adopted into our current policies and procedures.
• Strategic Consultation: Research developing standards and regulatory requirements and advise leadership on needed system changes, emerging obligations, and potential competitive differentiators.
• Independent Review: Provide an objective perspective to IT operations in support of cybersecurity compliance, control effectiveness, and related improvement activities.
• Provider Coordination: Coordinate compliance and audit activities with managed service providers.
• Surveillance Audits: Coordinate recurring surveillance and certification audits with corporate staff and external auditors, including annual ISO activities when required.
• Regulatory Awareness: Maintain current knowledge of relevant standards, regulations, contractual requirements, and industry practices.

Required Qualifications

• Education: Bachelor's degree in information technology, cybersecurity, business administration, or a related field.
• Experience: 3-5+ of experience in internal auditing, compliance management, quality assurance, or a closely related function.
• Framework Experience: Demonstrated experience supporting or managing CMMC or NIST SP 800-171, ISO 9001, ISO 20000, or ISO 27001, and CMMI implementations.

Skills and Certifications

• Required Certifications: Security +
• Technical Literacy: Strong understanding of IT systems and processes, cybersecurity controls, data protection requirements, and supply chain risk management.
• Communication: Exceptional technical writing and communication skills, including the ability to translate complex regulations into clear, practical guidance.
• Clearance: The ability to obtain and maintain a U.S. government-issued security clearance is required.

Additional Requirements

• Collaboration: Strong interpersonal skills and the ability to work effectively with corporate teams, technical personnel, service providers, customers, and external assessors.
• Travel: Ability to travel occasionally based on business and audit requirements.
• Other Responsibilities: Perform other duties as assigned in support of corporate compliance, quality, and operational priorities.