Lead CMMC Analyst

Optomi; United States; On-site; USD 120,000 - 160,000; Full time

Job summary

Optomi, in partnership with a leading Healthcare provider, seeks a Lead CMMC Analyst to oversee the implementation of the CMMC framework in government contracting environments. You will manage programs, align policies, and ensure controls meet DFARS 252.204-7012, NIST 800-171 rev 2, and FedRAMP requirements.

Responsibilities include planning, assessments, gap analysis, remediation guidance, and training to elevate cybersecurity maturity.

Qualifications

• In-depth knowledge of cybersecurity principles and frameworks (e.g., NIST SP 800-171).
• Strong understanding of the CMMC model and its requirements.
• Experience performing security assessments or audits.

Responsibilities

• Program planning and project scoping for CMMC implementation.
• Facilitate comprehensive assessments to gauge compliance levels.
• Formulate and implement compliance strategy and gap closure.
• Create and manage POA&Ms to address gaps and improve posture.
• Prepare detailed compliance reports and remediation guidance.
• Develop training sessions to educate staff on CMMC requirements.
• Continuously update controls and practices with regulatory changes.

Skills

CMMC knowledge

NIST SP 800-171

Security assessments

Risk assessment

Stakeholder communication

Teamwork

Strategic thinking

Certifications

Job description

Optomi, in partnership with a leading provider in the Healthcare industry is seeking a Lead CMMC Analyst to join their team! In this role, you will be responsible for overseeing and managing the implementation of the CMMC framework within an organization. They ensure that all necessary processes, policies, and controls are in place to achieve and maintain compliance with the cybersecurity requirements set forth by the CMMC. This role requires significant government contracting experience, including an in-depth understanding of DFARS 252.204-7012, NIST 800-171 rev 2, FedRAMP, and CMMC.

Main Responsibilities:

• Program Planning: Develop a comprehensive plan for implementing the CMMC requirements within the organization. This includes defining project scope, objectives, timelines, and resource allocation. This also includes ensuring all relevant required documents are maintained and kept up to date i.e. Risk Assessment, Plans of Actions and Milestones, SSP, etc.
• Facilitating Assessments: Facilitate comprehensive assessments of organizations' cybersecurity practices, policies, and controls to determine their compliance level with the CMMC requirements. This will require reviewing documentation, updating controls based on system owner interviews, and conducting technical evaluations.
• Compliance Strategy: Formulate strategies to achieve and maintain compliance with the CMMC framework. This involves assessing existing cybersecurity practices and identifying gaps that need to be addressed.
• Gap Analysis: Identify gaps in an organization's cybersecurity posture by comparing their existing measures against the requirements outlined in the CMMC framework. Provide recommendations on how to bridge those gaps and achieve certification. Create and manage POA&Ms to address identified gaps.
• Compliance Reporting: Prepare detailed reports on assessment findings, including areas of non-compliance, vulnerabilities, and suggested remediation actions. These reports are used to guide organizations in improving their cybersecurity practices.
• Remediation Guidance: Collaborate with application teams to develop remediation plans that address identified weaknesses or non-compliance issues. Offer guidance on implementing appropriate security controls and best practices.
• Training and Education: Develop training sessions or workshops to educate employees about the importance of cybersecurity best practices and how they align with the CMMC requirements.
• Continuous Improvement: Stay updated on changes in regulations, industry standards, emerging cyber threats, and advancements in technology relevant to the CMMC framework. Continuously evaluate and enhance cybersecurity measures accordingly.

Experience Required:

• In-depth knowledge of cybersecurity principles, frameworks, standards (such as NIST SP 800-171), and best practices.
• Strong understanding of the CMMC model and its specific requirements.
• Experience conducting security assessments or audits.
• Proficiency in risk assessment methodologies.
• Excellent analytical skills to identify vulnerabilities and recommend solutions.
• Effective communication skills to interact with stakeholders at all levels within an organization.
• Ability to work independently or as part of a team.
• Ability to think strategically while also paying attention to detail.
• Relevant industry certifications such as Certified CMMC Professional (CCP), Certified CMMC Assessor (CCA), Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or Certified Ethical Hacker (CEH) may be beneficial but not always required.