GRC Program and CMMC Compliance Lead

PAR Systems UK Ltd; Saint Paul (MN); On-site; USD 135,000 - 165,000; Full time

Benefits offered by this job

401(k) & matching

Medical Insurance

Dental Insurance

Vision Insurance

Disability & Life Insurance

PTO

Job summary

PAR Systems UK Ltd. is seeking a GRC Program and CMMC Compliance Lead to build and mature our enterprise Governance, Risk & Compliance program with an initial focus on CMMC readiness and ongoing compliance.

This role partners with Information Systems, Procurement, and business leaders to translate complex requirements into practical expectations, establish repeatable processes, and deliver meaningful risk reporting.

Qualifications

• Three or more years of progressive experience in governance, risk, compliance, IT audit, information security, or cybersecurity compliance.
• Hands-on experience implementing, assessing, or managing NIST SP 800-171 and/or CMMC requirements and self-assessments.
• Working knowledge of CMMC Level 2, NIST SP 800-171 Rev. 2, NIST SP 800-171A assessment objectives, DFARS 252.204-7012, and applicable CMMC contract requirements.
• Experience developing and maintaining a System Security Plan, managing Plan of Action & Milestones, control narratives, system descriptions, asset inventories, data-flow documentation, and assessment evidence.
• Working knowledge of CMMC assessment scoping, including CUI and FCI identification, system boundaries, security protection assets, shared services, cloud environments, and external service providers.
• Strong documentation and evidence-management skills, with demonstrated ability to maintain current compliance artifacts, track cybersecurity findings, coordinate remediation, and drive POA&M items through validated closure.
• US Person

Responsibilities

• Lead the build and maturation of PAR's GRC program with initial focus on CMMC readiness.
• Coordinate NIST SP 800-171 self-assessments, SSP, POA&M, and evidence.
• Translate requirements into practical business expectations and establish accountability.
• Collaborate with IT, procurement, and external advisors to drive remediation and closure of findings.
• Develop repeatable processes, reporting, and governance across PAR.

Skills

Governance & Risk

IT Audit

Cybersecurity Compliance

NIST SP 800-171

CMMC

Documentation & Reporting

US Person

Job description

PAR Systems is seeking a GRC Program and CMMC Compliance Lead to build and mature our enterprise Governance, Risk & Compliance (GRC) program, with an initial focus on advancing PAR’s CMMC readiness and ongoing compliance.

This is an opportunity to build, not simply maintain. You’ll establish practical frameworks, processes, controls, risk practices, and reporting that strengthen cybersecurity and IT governance across PAR. While CMMC is an important near-term priority, your impact will extend into a broader GRC capability supporting PAR’s enterprise risk program.

You’ll partner with Information Systems, Procurement, business leaders, control owners, and external CMMC advisors to translate complex requirements into practical business expectations. This role requires the judgment to make recommendations, provide credible challenge, coach stakeholders, and validate that requirements are being met—not simply interpret regulations or manage a compliance project.

Success Criteria

Your GRC experience will help you establish a practical, sustainable program with clear ownership, repeatable processes, and meaningful measures of risk and compliance. You’ll conduct focused cybersecurity and IT risk assessments, strengthen governance practices, establish useful reporting, and help leaders understand and respond to risk.

An immediate priority will be strengthening PAR’s CMMC Level 2 readiness. You’ll lead the NIST SP 800-171 self-assessment process, validate that the SSP, POA&M, controls, and supporting evidence accurately reflect the operating environment, and coordinate identified gaps through resolution. You’ll work closely with technical owners responsible for implementation and external advisors who provide specialized CMMC expertise.

Success means making compliance practical for the business. You’ll translate regulatory, contractual, and customer requirements into clear expectations, establish accountability, challenge gaps when needed, and help ensure PAR remains prepared for assessments and ongoing compliance as requirements and the business evolve.

Qualifications – Required

• Three or more years of progressive experience in governance, risk, compliance, IT audit, information security, or cybersecurity compliance.
• Demonstrated hands‑on experience implementing, assessing, or managing NIST SP 800-171 and/or CMMC requirements and self‑assessments. Experience limited solely to general awareness or indirect exposure is not sufficient.
• Working knowledge of CMMC Level 2, NIST SP 800-171 Rev. 2, NIST SP 800-171A assessment objectives, DFARS 252.204-7012, and applicable CMMC contract requirements.
• Experience developing and maintaining a System Security Plan, managing Plan of Action & Milestones, control narratives, system descriptions, asset inventories, data‑flow documentation, and assessment evidence.
• Working knowledge of CMMC assessment scoping, including CUI and FCI identification, system boundaries, security protection assets, shared services, cloud environments, and external service providers.
• Strong documentation and evidence‑management skills, with demonstrated ability to maintain current compliance artifacts, track cybersecurity findings, coordinate remediation, and drive POA&M items through validated closure. Strong analytical, organizational, written, verbal, and cross‑functional communication skills.
• US Person

Qualifications – Preferred

• Experience significantly supporting a CMMC Level 2 or DFARS cybersecurity compliance program, including preparation for or participation in a C3PAO, DIBCAC, or comparable NIST-based assessment.
• Experience supporting cybersecurity requirements and flow‑downs across subcontractors and suppliers, including applicable DFARS compliance obligations.
• CCP, CISA, CISSP, CRISC, CCA, or comparable certification or assessment experience.
• Knowledge or experience with third party risk management programs and reviews.
• Experience supporting organizations in defense, aerospace, nuclear, space, or other highly regulated industries.

Benefits

• Global team recognized for their passion of inventing
• First-of-a-kind product culture and project exposure
• Training and development from industry-leading experts
• Cutting edge benefit programs that include: 401(k) & matching; Medical, Dental, Vision Insurance; Disability & Life Insurance; PTO, Paid Holidays, & Parental Leave for both Parents; Tuition Reimbursement

PAR Systems is an equal opportunity employer and we value individuals with a variety of backgrounds and experiences. We do not discriminate on the basis of race, color, religion, sex, national origin or any other status protected by applicable law. We use AI to assist with sorting applications, but real humans do all the evaluating and deciding. If selected for an interview, please advise our Human Resources department if you require accommodation during the interview or assessment process and we will support your accessibility needs. We offer market competitive pay and benefits based upon the candidate’s skills, experience, qualifications, and internal equity. Our starting rate of pay for this salaried position is targeted at $135,000-165,000 annually.

#AreaOfInterest:Other