Senior CMMC/NIST Compliance Lead — Hybrid Role

ISI; Reston (VA); Hybrid; USD 125,000 - 140,000; Full time

Benefits offered by this job

Hybrid work

Competitive salary & benefits

Professional growth opportunities

Job summary

ISI seeks a Compliance Manager with a strong technical background to lead CMMC/NIST 800-171a efforts for US government contractors. You will manage a team of analysts, oversee gap assessments, remediation projects, and communicate with clients and auditors.

Responsibilities include owning deliverables (SSPs, POA&Ms, policies), developing templates and playbooks, tracking timelines and budgets, and coordinating with Cybersecurity, Engineering, and Support teams to ensure compliant configurations.

Qualifications

• Must present proof of U.S. citizenship before hire.
• Have at least 5 years of experience in the Defense Industrial Base as a compliance manager or related position.
• Possess a strong technical background and understanding of the 'How' for NIST controls and not just the 'What'.
• Must hold a CMMC RP, CCP or CCA certification.
• Be detail oriented, process driven, and well organized.
• Have worked for or with an MSP and C3PAO.
• Be comfortable speaking and/or presenting to clients and team members.
• Have professional level verbal and written communications skills.
• Familiar with NIST RMF and CMMC compliance.
• Self-starter, proactive in helping across engagements.

Responsibilities

• Lead, mentor and develop a team of analysts through NIST 800-171a gap assessment and remediation projects.
• Participate in hiring, onboarding, and training new analysts on ISI’s assessment methods and tools.
• Conduct performance reviews and support analysts’ professional development, including CMMC certification paths (CCP/CCA).
• Balance team workload across concurrent client engagements to meet deadlines without sacrificing quality.
• Own quality control for all compliance deliverables (SSPs, POA&Ms, policies, evidence packages).
• Build and maintain standard templates, checklists, and playbooks for consistent assessments.
• Track engagement progress against timelines and budgets, escalate risks to leadership early.
• Act as the primary compliance point of contact for assigned clients, setting expectations and managing escalations.
• Report on team metrics and client status to leadership (SPRS score progress, open POA&Ms, audit readiness).
• Monitor changes to CMMC, DFARS, and NIST guidance, updating processes and guidance accordingly.
• Gather lessons learned from C3PAO audits and feed them back into ISI’s methods and training.
• Work directly with ISI client stakeholders during onboarding and gap assessments.
• Review client environments and collect evidence to determine satisfaction of CMMC/NIST controls.
• Assist clients in formulating a compliant set of policies and procedures.
• Complete documentation required for a compliance assessment (Network Design Documents, Software Whitelist, etc).
• Recommend solutions to remediate identified gaps in compliance.
• Coordinate with Cybersecurity, Engineering, and Support to ensure configurations are compliant.
• Generate POAMs (Plan of Action and Milestones) and SSPs reflecting deployed tools and assessment results.
• Interface with C3PAO auditors during CMMC Level 2 Audits.

Skills

Team leadership

NIST 800-171a

CMMC

CCP/CCA

C3PAO experience

Communications

Citizenship proof

Job description

ISI seeks a Compliance Manager with a strong technical background to lead CMMC/NIST 800-171a efforts for US government contractors. You will manage a team of analysts, oversee gap assessments, remediation projects, and communicate with clients and auditors.

Responsibilities include owning deliverables (SSPs, POA&Ms, policies), developing templates and playbooks, tracking timelines and budgets, and coordinating with Cybersecurity, Engineering, and Support teams to ensure compliant configurations.