Cybersecurity Compliance Analyst

DigiFlight, Inc.; Huntsville (AL); On-site; USD 90,000 - 120,000; Full time

Job summary

DigiFlight, Inc. in Huntsville, AL seeks a Cybersecurity Governance, Risk & Compliance professional to support the organization’s cybersecurity and regulatory compliance program.

You will assist in reviewing, maintaining, and implementing security standards, policies, and procedures for internal operations and external client services. Responsibilities include leading or supporting CMMC readiness, audits, evidence collection, and remediation guidance; reporting to the Director of Cybersecurity

Qualifications

• 3–5 years of experience in cybersecurity governance, risk, and compliance (GRC).
• Experience with multiple frameworks (CMMC/NIST SP 800-171, NIST SP 800-53, ISO/IEC 27001:2022, FedRAMP, SOC 2, CMMI).
• Cyber AB RP or CCP/CCA certifications are a plus.

Responsibilities

• Support the cybersecurity and regulatory compliance program for internal operations and client services.
• Lead or support CMMC readiness, audits, gap assessments, and readiness assessments; report findings and recommendations.

Skills

GRC expertise

Control evaluation

Executive communication

Audits & readiness

Stakeholder engagement

Documentation & evidence

Job description

Responsible for supporting the organization’s cybersecurity and regulatory compliance program. Assists the Director ofCybersecurityCompliance in reviewing,maintaining, and implementing security standards, policies, and procedures applicable to internal operations and external client services. As directed by the Director ofCybersecurityComplianceor Director of Quality Management:

• SupportsDigiFlight’sCybersecurity Maturity Model Certification (CMMC) Level 2readiness,certification, and maintenance in support of DoD contract requirements.
• LeadsorparticipatesininternalCMMC control audits, gap assessments, and readinessassessments,compiles findings, observations, and recommendations and reports results to the Director ofCybersecurityCompliance.
• As a Cyber AB Registered Practitioner (RP),leads orsupports delivery of CMMC services for external organizations, including gap assessments and readiness assessments, and provides documented remediation recommendations aligned with CMMC requirements.
• Assistsinternal stakeholders andexternalclients with compliance-related activities, including evidence collection, interviews, and clarification of control implementation expectations.
• Periodically reviews and audits compliance documentation, including policies, procedures, System Security Plans (SSPs), and supporting artifacts, to verify alignment with applicable regulatory and contractual requirements.
• Performs orparticipatesin quality audits and appraisals; compiles findings and reports to the Quality Control Manager/Sr.Directorduring the audits.
• Maintains and updates cybersecurity and compliance documentation, including policies, procedures, and SSPs, to ensure accuracy and consistency with implemented controls and organizational practices.
• Prepares Configuration Control Board (CCB) agendas, facilitates CCB meetings, and documents decisions, approvals, and action items to support change and configuration management governance.
• Facilitates Vulnerability Management meetings, including review of vulnerability scan results, remediation activities, and risk acceptance decisions; tracks corrective actions and supports continual improvement efforts.
• Assists the Director ofCybersecurityCompliance andprocessaction owners with corrective actions, remediation planning, and compliance improvement initiatives; compiles reports andrecommendationsandfacilitatescommunication withappropriate personnel.

CMMC Readiness & Pre-Assessment Advisory

• Lead or supportclientreadiness reviews and mock assessments
• Evaluate organizational preparedness for CMMC certification
• Certification boundary definition
• Evidence sufficiency and documentation quality
• Identifyrisks that mayimpactassessment outcomes

3–5 years of experience in cybersecurity governance, risk, and compliance (GRC) including experience with one or more of the following frameworks or programs:

• CMMC/ NIST SP 800-171
• NIST SP 800-53
• ISO/IEC27001: 2022
• FedRAMP
• SOC 2
• CMMI
  
• Cyber AB Registered Practitioner (RP)
• Cyber ABCMMCCertified Professional (CCP) or Cyber AB CMMC Certified Assessor (CCA)
• Familiarity with the generative and agentic AI
• CGRC or equivalent security or compliance certification
• Experience supporting gap assessments, readiness assessments, or third-party audits

Required Skills

• Experience working with or within3PAOs or accredited assessment bodies
• Familiarity with federal frameworks such as: FedRAMP
• DFARS 252.204-7012
• Experience assessing complex environments (cloud, hybrid, MSPs, enclaves)
• Strong judgment and decision-making authority
• Deep expertise in control evaluation and evidence validation
• Ability to assess ambiguous or partially implemented controls
• Executive-level communication and stakeholder engagement
• Ability to work effectively with personnel at all organizational levels, including leadership and external clients
• Strong organizational and documentation skills with attention to detail
• Proficiencywith Microsoft Office applications, including Word, Excel, PowerPoint, and SharePoint
• High ethical standards and professional integrity

Considerations

• Must avoid conflicts of interest in accordance with applicable CMMC ecosystem expectations