Senior Cybersecurity Compliance Consultant (US Remote)

Intelligent Technical Solutions; Washington (District of Columbia); Remote; USD 95,000 - 120,000; Full time

Benefits offered by this job

Medical Insurance Plan

Dental & Vision

Retirement Plan

Job summary

Intelligent Technical Solutions seeks a Security Advisor (Senior Cybersecurity Compliance Consultant) to serve as the security officer for a portfolio of clients. The role blends hands-on compliance delivery with client relationship ownership and risk management, shaping the practice's standards.

You will lead CMMC readiness, advise on major frameworks, and drive evidence collection and reporting while managing a high volume of engagements in a US-based remote role.

Qualifications

• CISSP active and in good standing at time of hire.
• CMMC CCP active at time of hire; CCA within 12 months.
• Minimum eight years in information security with 3+ years in compliance/vCISO.
• Deep depth across at least three regulatory frameworks.
• Experience presenting to auditors or regulators.
• U.S. person status required; remote work across U.S. time zones.

Responsibilities

• Client advisory and vCISO delivery for a portfolio of clients.
• Lead security program readiness and development of security roadmaps.
• Identify growth opportunities and manage contract health.
• Perform risk assessments and drive remediation actions.
• Lead CMMC Level 1/2 readiness engagements and SSP/POA&M work.
• Advise on DFARS, NIST, HIPAA, SOC 2, PCI DSS, and other frameworks.
• Map controls across frameworks to unified matrices.
• Oversee data collection and review security tooling outputs.
• Support incident response and contribute to playbooks.
• Maintain time entries in PSA and contribute to templates and processes.

Skills

Client communication

Relationship management

Regulatory compliance knowledge

Risk assessment

Leadership

Public speaking

Education

CISSP certification

CCP (CMMC Professional)

CCA (CMMC Assessor)

Tools

ConnectWise Manage

GRC tools (IntelliGRC/Drata/Onetrust)

Microsoft Defender/Sentinel

Job description

Job Qualifications

Job Description
Job Description
Job Summary
The Security Advisor (Senior Cybersecurity Compliance Consultant) delivers active security practice management engagements, serving as the assigned security officer (vCISO) for a portfolio of client organizations. The role combines hands‑on compliance delivery with client relationship ownership, risk management, and ongoing security advisory work. The role requires subject matter expertise across regulatory compliance frameworks, strong client‑facing communication, and organizational discipline to manage a high volume of concurrent engagements. This position sits at the senior end of the practice: it carries the most complex and highest‑regulatory‑risk engagements in the portfolio and sets the technical standard for the practice's compliance deliverables.
Job Responsibilities

• Client Advisory & vCISO Delivery:
• Serve as the assigned security officer (vCISO) for a portfolio of client engagements: lead recurring meeting cadences, act as the primary point of contact for clients' cybersecurity concerns and provide regular updates and reports on the status of security initiatives, including performance metrics, findings, and recommendations for improvement.
• Build strong client relationships, understand each client's unique regulatory and business requirements, and address their needs with tailored strategies and security roadmaps.
• Identify above-contract demand and security program growth opportunities within assigned accounts, surfacing right-sizing and expansion recommendations to practice leadership ahead of contract renewal.
• Track and maintain contract health ensuring that issues with delivery are communicated early.
• Compliance Program Delivery:
• Lead CMMC Level 1 and Level 2 readiness engagements: NIST SP 800-171 control assessments, System Security Plan (SSP) development, POA&M creation and management, SPRS score submission support, evidence collection, and client preparation for third‑party assessment.
• Advise clients on CUI scoping, DFARS 252.204-7012 and FAR 52.204-21 obligations, and enclave architectures, including Microsoft GCC High environments.
• Deliver compliance engagements across additional frameworks as assigned, including HIPAA / HITECH, SOC 2 (Types I and II), PCI DSS v4.0, FTC Safeguards Rule, GLBA, ISO/IEC 27001 and 27002, NIST Cybersecurity Framework 2.0, NIST SP 800-53, CIS Critical Security Controls v8, and AI governance (NIST AI RMF, ISO/IEC 42001).
• Advise on sector‑and state‑specific regimes as engagements require, including NY DFS 23 NYCRR Part 500, SEC cybersecurity disclosure rules, CJIS Security Policy, StateRAMP / FedRAMP readiness, and U.S. state privacy laws (CCPA/CPRA and successors) alongside GDPR and ISO/IEC 27701 where clients have international exposure.
• Map overlapping control sets across frameworks to build unified control matrices, eliminating duplicate evidence collection across a client's concurrent compliance obligations.
• Security Assessment & Engineering Support:
• Conduct comprehensive risk assessments to identify potential threats and vulnerabilities, develop and implement mitigation strategies to enhance clients' security postures, and monitor compliance with regulatory requirements and industry standards, recommending remediation actions to address gaps or deficiencies.
• Oversee data collection efforts to verify compliance and gather critical security information within client infrastructures, ensuring accuracy and reliability.
• Review and interpret security tooling outputs across the Microsoft security stack (Defender XDR, Sentinel, Entra ID Protection, Intune, Purview, Conditional Access) and coordinate remediation with client IT teams and internal engineers.
• Other Responsibilities:
• Perform general Security Officer duties, such as running security huddles, supporting cyber insurance questionnaires and attestations, and ensuring security tool functionality for assigned clients.
• Assist with incident response (IR) activities, including possibly participating in the on‑call incident escalation rotation, supporting SOC coordinators, communicating with key stakeholders during incidents, contributing to playbooks, and conducting postmortems with clients.
• Maintain accurate, timely time entries in the PSA (ConnectWise Manage); delivered hours are the practice's operational and financial source of truth.
• Contribute to scalable templates, engagement processes, and the practice knowledge base, fostering a culture of continuous improvement and knowledge sharing.
• Serve as an escalation resource on advanced framework interpretation and control‑determination questions, and support quality review of compliance deliverables prior to client or assessor submission.
• Stay informed about emerging threats, vulnerabilities, and regulatory changes — including the DoD's phased CMMC rollout — assessing their potential impact on clients and adjusting strategies accordingly.

Job Qualifications
Credentials & Eligibility:

• CISSP (active and in good standing) — required at time of hire. This is a hard requirement: commitments to obtain, lapsed or Associate‑level credentials, and equivalent‑experience substitutions will not be considered.
• CMMC ecosystem credentials required: CCP (Certified CMMC Professional) active at time of hire, with CCA (Certified CMMC Assessor) required within the first 12 months. Registered Practitioner (RP) status alone does not satisfy this requirement.
• Additional certifications a plus: CISM, CRISC, CISA, GIAC (GSLC, GCCC), CompTIA Security+, Security X, Microsoft SC‑series.
• Minimum eight (8) years of progressive information security experience, including at least three (3) years delivering compliance or vCISO engagements across a multi‑client portfolio in a consulting, MSP, or MSSP environment or something similar.
• Demonstrated ownership of at least two (2) completed CMMC Level 2 readiness engagements, or equivalent NIST SP 800-171 assessment work, including SSP authorship and POA&M management through to third‑party assessment.
• Documented working depth in a minimum of three (3) distinct regulatory frameworks — surface familiarity across many frameworks is not a substitute for demonstrated depth.
• Experience defending deliverables and control determinations directly to auditors, third‑party assessors, or regulators.
• U.S. person status (U.S. citizen or lawful permanent resident) required due to access to Controlled Unclassified Information (CUI) under DFARS flow‑down obligations.
• U.S.-based remote with reliable availability across U.S. business time zones; occasional travel to client sites for assessment support.

Technical Skills
Cybersecurity & Compliance Knowledge:

• Working command of cybersecurity principles and practices, including compliance standards and regulations such as CMMC / NIST SP 800-171 and 800-171A, NIST SP 800-53, NIST CSF 2.0, HIPAA / HITECH, SOC 2, PCI DSS v4.0, FTC Safeguards Rule, GLBA, ISO/IEC 27001 / 27002, and CIS Controls v8.
• Familiarity with the federal contracting compliance stack — DFARS 252.204-7012, 7019, 7020 and 7021, FAR 52.204-21, CUI marking and handling per 32 CFR Part 2002, and the phased CMMC rule.
• Awareness of adjacent privacy and sector regimes: U.S. state privacy laws, GDPR, NY DFS Part 500, SEC cyber disclosure obligations, and CJIS.
• Proficiency in incident response and threat mitigation strategies.

Risk Management

• Ability to conduct comprehensive risk assessments and map findings to security controls.
• Experience building and maintaining remediation plans (POA&Ms) and mitigation strategies.

Technical Tools

• Familiarity with cybersecurity tools and technologies (e.g., SIEM, EDR/XDR, IDS/IPS, firewalls), with Microsoft security stack experience preferred.
• Experience with GRC and compliance platforms (e.g., IntelliGRC, Vanta, Secureframe, Drata, Onetrust, FutureFeed) and evidence‑collection workflows.

Engagement Management Skills

• Ability to manage a high volume of concurrent client engagements (20–30 relationships) with disciplined prioritization.
• Strong scheduling and follow‑through; proficiency with PSA/ticketing and project tracking tools.
• Ability to work within — and improve — standardized templates and delivery processes.

Interpersonal Skills

• Excellent communication skills for interacting with client stakeholders from IT staff to executives; ability to translate technical findings into business terms.
• Ability to build and maintain strong client relationships and work effectively with coordinators and a distributed team.

Analytical And Reporting Skills

• Ability to track and report on engagement metrics, compliance status, and deliverable progress.
• Proficiency in generating clear client‑facing and executive‑level reports.
• Expertise in monitoring regulatory compliance and refining security policies and procedures based on industry best practices.

Professional Development

• Commitment to staying current on emerging trends and technologies in cybersecurity, the CMMC ecosystem, and evolving compliance requirements.
• Participation in industry training, conferences, and credential maintenance.

Compensation
Pay rate starts at $95,000.00 up to $120,000.00 annually (inclusive of delivery‑based bonus paid monthly) and may vary by experience and location.
Benefits

• Medical Insurance Plan
• Dental & Vision
• Life Insurance
• Disability Coverage
• Paid Time Off (starts at 15 days per year)
• Paid Maternity/Paternity Leave
• Paid US Holidays
• Retirement Plan
• Salary Advancement/Loan
• Health & Wellness Program
• Company‑paid training and certification
• Supplemental Life Insurance (Employee‑paid)
• Supplemental Health Plans (Employee‑paid)

Fraud Alert – Recruitment Scams
Intelligent Technical Solutions (ITS) has been made aware of fraudulent job postings and communications misrepresenting our company. Applicants are advised to exercise caution and apply only through official ITS channels.

• ITS does not request payment or financial information at any stage of the hiring process.
• Sensitive personal information (e.g., Social Security numbers) will not be requested prior to a formal offer.
• We have become aware of fake profiles on LinkedIn, Facebook, and other social media platforms impersonating our employees and falsely claiming to represent our company. Please exercise caution when interacting with these accounts.
• If you receive suspicious messages or requests, do not engage. Report them to [e-mail].
• All verified job openings are posted here: -openings.