Hybrid DoD CMMC Program Manager

Balfour Beatty US; Falls Church, Northern (VA, KY); Hybrid; USD 125,000 - 195,000; Full time

Job summary

Balfour Beatty Construction, LLC is seeking a CMMC Program Manager to lead the organization's CMMC compliance program for its DoD and federal contracts. The role focuses on governance, reporting, monitoring, and organizational adoption of security requirements to protect FCI and CUI.

The ideal candidate will manage annual self-assessments, coordinate with C3PAOs, and liaise with IT, Legal, and Operations to maintain SSPs, POA&Ms, and evidence repositories.

Qualifications

• Bachelor’s degree in Risk Management, Compliance and Regulation, Information Security, Information Systems, or related field.
• 7+ years in cybersecurity, governance, risk management, compliance, or information security.
• Experience with NIST SP 800-171, FAR/DFARS requirements, and CMMC concepts.

Responsibilities

• Lead CMMC compliance program across the secure enclave and coordinate with IT, Legal, Operations and executive leadership.
• Develop and maintain the Continuous Monitoring Plan (CMP) and ISCM procedures.
• Oversee policies, standards, procedures and supporting documentation related to CMMC.
• Manage ISCM strategy, risk tolerance, and reporting cadence with senior stakeholders.
• Lead risk assessments, internal audits, and coordination with C3PAOs for external assessments.
• Prepare metrics dashboards and executive reports on enclave risk posture and trends.
• Coordinate third-party providers and review security documentation and responsibilities.

Skills

CMMC governance

NIST SP 800-171

FAR/DFARS

Compliance management

Executive reporting

Education

BA in Risk Mgmt / InfoSec

Job description

Balfour Beatty Construction, LLC is seeking a CMMC Program Manager to lead the organization's CMMC compliance program for its DoD and federal contracts. The role focuses on governance, reporting, monitoring, and organizational adoption of security requirements to protect FCI and CUI.

The ideal candidate will manage annual self-assessments, coordinate with C3PAOs, and liaise with IT, Legal, and Operations to maintain SSPs, POA&Ms, and evidence repositories.