Governance, Risk, and Compliance Manager

SDFM; Rock Hill (SC); On-site; USD 120,000 - 150,000; Full time

Job summary

Powerus is seeking a Governance, Risk, and Compliance (GRC) Manager to build and run the company’s CUI and export‑controlled data compliance program, lead the path to CMMC Level 2 certification, and maintain alignment with NIST SP 800‑171 and SP 800‑53 Rev. 5.

The role collaborates with IT, engineering, legal, contracts, and export compliance to manage SSP/POA&M, SPRS submissions, and risk oversight. Occasional travel to company sites and supplier reviews is required.

Qualifications

• Five or more years in GRC, information security compliance, or audit.
• Hands-on with NIST SP 800-171, CMMC Level 2, and DFARS 252.204-7012/7019/7020/7021.
• Experience writing and maintaining an SSP and POA&M; SPRS self-assessments.
• Knowledge of ITAR/EAR controls and risk management processes.
• Ability to obtain a U.S. Government Secret clearance; U.S. citizenship required.

Responsibilities

• Own the CMMC Level 2 program, including gap assessments and readiness for third‑party assessment.
• Write and maintain the SSP, POA&M, CUI boundary and data‑flow documentation, and evidence for NIST 800‑171.
• Manage SPRS score submissions and document compliance with DFARS requirements.
• Maintain control mappings between NIST SP 800‑53 Rev. 5, 800‑171, and CMMC.
• Lead enterprise risk register, risk assessments, and reporting of risk posture to leadership.
• Run the CUI program (identification, marking, handling, storage, transmission, destruction).
• Coordinate export compliance (ITAR/EAR) controls on data, systems, and procedures.
• Support internal/external audits, training, and policy reviews.

Skills

GRC experience

Information security

Risk management

Audit

Education

Bachelor's degree in information security

Job description

About Powerus

Powerus is building a next-generation American autonomous systems platform designed to move, protect, and sustain critical assets in high-consequence environments. The company combines advanced autonomy, manufacturing capability, operational expertise, and strategic acquisitions to support defense, national security, critical infrastructure, and commercial operations globally.

Mission

Our mission is to deliver resilient autonomous technologies that strengthen national security, improve operational safety, and expand the capabilities of organizations operating in complex environments.

Why Join Powerus

Powerus handles Controlled Unclassified Information (CUI) and export-controlled technical data under Department of Defense contracts. CMMC Level 2 certification is a condition of contract award, and the compliance program must keep pace with the company's growth across engineering and manufacturing.

This role owns that program: the System Security Plan, POA&M, SPRS score, policy set, risk register, and assessment readiness. It works with IT, engineering, legal, contracts, and export compliance.

Position Overview

Powerus is seeking a Governance, Risk, and Compliance (GRC) Manager to build and run the company's compliance program for CUI and export-controlled data, lead the path to CMMC Level 2 certification, and maintain alignment with NIST SP 800-171 and NIST SP 800-53 Rev. 5.

Key Responsibilities

• Own the CMMC Level 2 program, including gap assessments, remediation tracking, and readiness for third‑party (C3PAO) assessment
• Write and maintain the System Security Plan (SSP), POA&M, CUI boundary and data‑flow documentation, and supporting evidence for all NIST SP 800-171 requirements
• Manage NIST SP 800-171 self‑assessments and SPRS score submissions; document compliance with DFARS 252.204‑7012, -7019, -7020, and -7021
• Maintain control mappings and crosswalks between NIST SP 800‑53 Rev. 5, NIST SP 800‑171, and CMMC; support customer and agency assessments that use 800‑53‑based baselines
• Track NIST SP 800‑172 enhanced requirements and advise leadership on applicability
• Run the CUI program: identification, marking, handling, storage, transmission, and destruction, in accordance with the DoD CUI program and NARA guidance
• Work with export compliance and legal to reflect ITAR and EAR controls on technical data in access controls, systems, and procedures
• Maintain the information security policy set, standards, and procedures on a defined review cycle
• Maintain the enterprise risk register, lead risk assessments, track treatment plans, and report risk posture to leadership
• Manage vendor and supply‑chain risk, including DFARS and CMMC flow‑down to subcontractors and FedRAMP Moderate (or equivalent) verification for cloud service providers
• Own cyber incident reporting procedures, including the 72‑hour DoD reporting requirement under DFARS 252.204‑7012 and evidence preservation
• Coordinate internal audits, customer security questionnaires, and external assessments
• Run security awareness, CUI handling, and insider‑threat training and track completion
• Review security and compliance clauses in solicitations and agreements for contracts and business development

Qualifications

• Must be located in the United States, within commuting distance of Rock Hill, SC
• Bachelor's degree in information security, information systems, or a related discipline, or equivalent practical experience
• Five or more years in GRC, information security compliance, or audit, including three or more years in the U.S. defense industrial base or a government‑contracting environment
• Hands‑on experience with NIST SP 800‑171, CMMC Level 2, and DFARS 252.204‑7012, -7019, -7020, and -7021
• Experience implementing or assessing NIST SP 800‑53 Rev. 5 controls
• Experience writing and maintaining an SSP and POA&M and performing SPRS self‑assessments
• Working knowledge of CUI handling requirements and of ITAR and EAR
• Experience running a policy program, risk register, and third‑party risk process
• Experience preparing for or supporting external audits or assessments
• Ability to travel occasionally to company sites, assessments, and supplier reviews
• Ability to obtain and maintain a U.S. Government Secret security clearance
• U.S. citizenship required; this role involves access to ITAR‑ and EAR‑controlled technical data

Preferred Qualifications

• CISSP, CISM, CISA, Certified CMMC Professional (CCP), or Certified CMMC Assessor (CCA)
• Export compliance credentials, such as ECoP
• Experience supporting a successful C3PAO or DIBCAC assessment
• Familiarity with NIST SP 800‑172, NIST CSF, ISO 27001, and FedRAMP
• Experience in a manufacturing or hardware environment, including engineering data and OT systems
• Experience with GRC tooling and Google Workspace security controls
• Active U.S. Government Secret security clearance

What We Look For

Candidates should have written or maintained an SSP and POA&M for a defense contractor and be able to describe the assessment it supported and its outcome.

Equal Opportunity Statement

Powerus is an equal opportunity employer committed to building a diverse and mission‑driven workforce. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability status, protected veteran status, or any other characteristic protected by applicable law.