Compliance Manager and Technical Solutions Lead

Society of Defense Financial Management; Arlington (VA); Remote; USD 110,000 - 135,000; Full time

Benefits offered by this job

Medical, Dental, and Vision Insurance

401(k) with Company Match

Paid Time Off and Paid Holidays

Life and Disability Insurance

Job summary

Iviry, LLC is seeking a skilled CMMC Compliance Manager / Technical Solutions Lead. You will own engagements from assessment through remediation, readiness, and sustainment, combining GRC leadership with hands-on system administration and technical solutioning.

The role includes 50% governance/engagement ownership and 50% technical remediation, requiring expertise in Microsoft 365 GCC/GCC High, Entra ID, Intune, Defender, and secure enclaves. Remote with limited travel.

Qualifications

• Experience delivering cybersecurity compliance projects (NIST SP 800-171 and/or CMMC).
• Hands-on with SSPs, POA&Ms, findings and evidence packages.
• Ability to translate compliance findings into technical actions and verify controls.
• Experience administering Microsoft 365, Entra ID, Intune, Defender, and scripting.

Responsibilities

• Own NIST SP 800-171 and CMMC engagements from assessment to sustainment.
• Develop, review, and maintain SSPs and POA&Ms; write control narratives.
• Drive remediation plans with actions, owners, and schedules.
• Coordinate evidence collection and assessor interaction with customers.
• Deliver repeatable technical solutions and escalate advanced work to senior engineers.

Skills

CMMC compliance

GRC leadership

Customer-facing

Microsoft 365

Entra ID

Intune

Defender

PowerShell

Networking

Education

Bachelor's degree

Tools

Microsoft 365 GCC/GCC High

Azure Government

PowerShell

Job description

About Iviry

Iviry, LLC is a well-established, rapidly growing, veteran-owned IT services company providing Managed Services and Managed Security Services (MSP/MSSP) including a Security Operations Center (SOC). Our cyber-compliance focus is on National Institute of Standards and Technology and Cybersecurity Maturity Model Certification (NIST/CMMC) Gap Analysis, Remediation, Compliance, Cyber Hygiene and Sustainment primarily for Defense Industrial Base (DIB) contractors but also including commercial companies as well as local, municipal and state agencies. Iviry supports multiple customer environments in an established compliance program covering the entire United States and a healthy, growing pipeline extending into Indo-PACOM (Philippines, Australia, Japan, Guam, Hawaii).

Position Summary

Iviry is seeking a self-directed, technically capable CMMC Compliance Manager / Technical Solutions Lead to own customer cybersecurity compliance engagements from assessment through remediation, readiness, and sustainment. This customer-facing role combines GRC leadership with hands-on systems administration, technical solutioning, and implementation.

The successful candidate will quickly assume ownership of active engagements, manage SSPs and POA&Ms, coordinate customers and technical resources, execute common remediation, and validate controls and evidence. Prior customer-facing CMMC or NIST SP 800-171 service-delivery experience is essential.

The role is approximately 50% GRC/CMMC engagement ownership and 50% technical remediation and project delivery. The individual must be able to lead repeatable work involving Microsoft 365 GCC/GCC High, secure enclaves, identity, endpoint security, logging, monitoring, and firewall requirements. Complex architecture, advanced networking, major migrations, and nonstandard engineering will be escalated to senior engineering resources. Limited travel may be required.

Location

Remote; Limited travel may be required.

Salary

A salary range of $110,000 - $135,000 is available for this position. Actual compensation will be determined based on factors including experience, education, certifications, technical qualifications, security clearance, and internal equity. In addition to base salary, this position is eligible for a comprehensive benefits package.

• Medical, Dental, and Vision Insurance
• 401(k) with Company Match
• Paid Time Off and Paid Holidays
• Life and Disability Insurance

Primary Responsibilities

Compliance, GRC & Engagement Ownership

• Own assigned NIST SP 800-171 and CMMC customer engagements from initial assessment through remediation, assessment readiness, and sustainment.
• Perform compliance assessments and gap analyses and determine the current state of customer environments against applicable requirements and assessment objectives.
• Develop, review, maintain, and actively manage System Security Plans (SSPs), POA&Ms, security policies, procedures, control narratives, and supporting compliance documentation.
• Develop and drive remediation plans that define findings, required actions, dependencies, owners, priorities, schedules, and completion criteria.
• Coordinate evidence collection, control validation, readiness reviews, assessor/C3PAO interaction, and customer response activities.
• Maintain accurate engagement plans, schedules, risks, dependencies, action items, and customer communications.
• Serve as a customer-facing delivery lead, explaining requirements, implementation options, risk, remediation priorities, and project status.
• Support sustainment activities, recurring reviews, continuous monitoring, and maintenance of compliance artifacts after initial remediation.

Technical Project Ownership

• Assume project ownership of active engagements following a focused transition and establish or rebuild project plans when needed.
• Translate findings and POA&M items into technical work packages with defined tasks, dependencies, schedules, and resource needs.
• Coordinate customer, compliance, and engineering participants and maintain accountability for assigned actions.
• Track planned versus completed work, surface blockers early, and maintain accountability for assigned actions.
• Maintain clear project status and ensure completed technical work is documented, validated, and reflected in the applicable compliance artifacts.
• Support accurate timekeeping, task completion, and billable-work documentation associated with customer engagements.

Technical Remediation & Systems Administration

• Independently execute and validate routine and intermediate technical remediation associated with NIST/CMMC findings and established standards.
• Perform hands-on administration and security configuration within Microsoft 365, Entra ID, Intune, Defender, and related Microsoft security and compliance platforms.
• Implement identity and access controls, including account configuration, privileged access, authentication, and Conditional Access.
• Implement endpoint security baselines, device-management policies, endpoint protection, and configuration hardening.
• Configure logging, monitoring, alerting, auditing, and evidence-generation capabilities required by compliance objectives.
• Validate implemented controls technically and confirm that remediation satisfies the associated compliance requirement and evidence objective.
• Document configurations, implementation decisions, validation results, and assessment-ready evidence.
• Improve Iviry's compliance delivery methodology through repeatable workflows, procedures, checklists, templates, evidence standards, and quality controls.
• Escalate advanced architecture, cloud engineering, infrastructure, networking, major migrations, and other work beyond the role's competency while coordinating remediation through completion.

Technical Compliance Projects & Solutioning

• Lead technical compliance projects involving Microsoft 365 GCC/GCC High, secure enclaves, identity, endpoint management, security baselines, logging, and monitoring.
• Conduct customer discovery to define enclave boundaries, users, devices, applications, data flows, licensing, dependencies, implementation activities, and acceptance criteria.
• Determine whether firewalls, network segmentation, secure remote access, logging, monitoring, or related capabilities are required.
• Develop firewall and network-security requirements and coordinate selection, procurement, onsite activities, configuration, testing, documentation, and validation.
• Develop project scopes, implementation plans, technical work packages, assumptions, dependencies, resource requirements, validation procedures, and customer handoff documentation for assigned technical projects.
• Independently deliver repeatable technical solutions within established Iviry standards and elevate complex architecture, advanced networking, major migrations, and nonstandard requirements to senior engineering resources.

Required Qualifications

• 3-5 years of relevant experience delivering cybersecurity compliance, systems administration, security engineering, or technical remediation services.
• Prior customer-facing experience in an MSP, MSSP, RPO, C3PAO, cybersecurity consultancy, or comparable professional-services organization supporting Defense Industrial Base (DIB) customers through multiple NIST SP 800-171 and/or CMMC engagements involving assessment, remediation, readiness, or sustainment.
• Hands-on experience managing SSPs, POA&Ms, findings, remediation actions, control narratives, evidence packages, assessment readiness activities, and C3PAO support through completion.
• Demonstrated ability to translate compliance requirements and assessment findings into practical technical actions and implement and validate the resulting security controls.
• Hands-on competency administering and securing Microsoft 365, including Entra ID, Intune, Defender, and PowerShell used to execute, review, troubleshoot, and safely modify scripts for administration, evidence collection, and repeatable remediation.
• Working knowledge of Microsoft 365 GCC/GCC High, secure enclaves, firewalls, network segmentation, VPN/remote access, secure data flows, logging, monitoring, and administrative access.
• Experience independently owning and managing multiple technical projects or customer engagements, including scope, schedules, dependencies, competing priorities, communication, documentation, and validation.
• Strong customer-facing consulting, facilitation, communication, and documentation skills with technical and non-technical stakeholders.
• Demonstrated ability to recognize technical complexity, work within defined competencies and standards, and engage senior engineering resources when advanced architecture or implementation support is required.

Preferred Qualifications

• Direct experience supporting GCC, GCC High, Azure Government, secure-enclave, or comparable regulated cloud projects.
• Relevant certifications such as:
• CompTIA Security+, CySA+, CASP+/SecurityX
• CISM, CRISC, CISSP
• ISO 27001 Lead Implementer/Auditor
• Cyber AB RP/CCA/CCP (if applicable)
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Security, Information Systems, Engineering, Management Information Systems, or a related discipline is preferred. Significant directly relevant CMMC, cybersecurity, systems-administration, engineering, or professional-services experience may be substituted for formal education.

Key Skills & Competencies

• Must be a U.S. Citizen.
• Timeliness and accuracy of work is essential.
• Clear communicator with both technical and non-technical audiences.
• Must be able to independently own assigned work while collaborating effectively with compliance, engineering, service-delivery, account-management, marketing, sales customer, and assessor stakeholders.
• Self-directed and capable of operating in ambiguous or evolving environments.
• Must be able to multi-task and dynamically adjust priority of effort.

Iviry, LLC is an Equal Opportunity Employer with a strong commitment to supporting and retaining a diverse and talented workforce.Iviry, LLC offers competitive compensation and benefits as well as great long-term career opportunities.

1901 South Bell Street, Suite 325, Arlington, VA 22202

866-960-9658 www.iviry.com