GRC Manager: CMMC & NIST Compliance (Defense)

SDFM; Rock Hill (SC); On-site; USD 120,000 - 150,000; Full time

Job summary

Powerus is seeking a Governance, Risk, and Compliance (GRC) Manager to build and run the company’s CUI and export‑controlled data compliance program, lead the path to CMMC Level 2 certification, and maintain alignment with NIST SP 800‑171 and SP 800‑53 Rev. 5.

The role collaborates with IT, engineering, legal, contracts, and export compliance to manage SSP/POA&M, SPRS submissions, and risk oversight. Occasional travel to company sites and supplier reviews is required.

Qualifications

• Five or more years in GRC, information security compliance, or audit.
• Hands-on with NIST SP 800-171, CMMC Level 2, and DFARS 252.204-7012/7019/7020/7021.
• Experience writing and maintaining an SSP and POA&M; SPRS self-assessments.
• Knowledge of ITAR/EAR controls and risk management processes.
• Ability to obtain a U.S. Government Secret clearance; U.S. citizenship required.

Responsibilities

• Own the CMMC Level 2 program, including gap assessments and readiness for third‑party assessment.
• Write and maintain the SSP, POA&M, CUI boundary and data‑flow documentation, and evidence for NIST 800‑171.
• Manage SPRS score submissions and document compliance with DFARS requirements.
• Maintain control mappings between NIST SP 800‑53 Rev. 5, 800‑171, and CMMC.
• Lead enterprise risk register, risk assessments, and reporting of risk posture to leadership.
• Run the CUI program (identification, marking, handling, storage, transmission, destruction).
• Coordinate export compliance (ITAR/EAR) controls on data, systems, and procedures.
• Support internal/external audits, training, and policy reviews.

Skills

GRC experience

Information security

Risk management

Audit

Education

Bachelor's degree in information security

Job description

Powerus is seeking a Governance, Risk, and Compliance (GRC) Manager to build and run the company’s CUI and export‑controlled data compliance program, lead the path to CMMC Level 2 certification, and maintain alignment with NIST SP 800‑171 and SP 800‑53 Rev. 5.

The role collaborates with IT, engineering, legal, contracts, and export compliance to manage SSP/POA&M, SPRS submissions, and risk oversight. Occasional travel to company sites and supplier reviews is required.