Senior Security Compliance Specialist

Fortem Technologies; Lindon (UT); On-site; USD 110,000 - 150,000; Full time

Job summary

Fortem Technologies is seeking an IT Security Compliance Specialist to lead the implementation, certification, and ongoing maintenance of CMMC Level 2 controls for CUI under NIST SP 800-171. The role combines hands-on security engineering with regulatory requirements to prepare for a C3PAO assessment and sustain continuous compliance across contracts.

The ideal candidate has 3–5+ years in IT security/compliance, experience with NIST SP 800-171/800-53, DFARS 252.204-7012, and practical work with

Qualifications

• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or equivalent experience.
• 3–5+ years IT security/compliance experience with NIST SP 800-171/800-53 or CMMC.
• Working knowledge of DFARS 252.204-7012, FAR 52.204-21, and CUI handling requirements.
• Experience with GCC High/Azure Gov/AWS GovCloud or similar CUI environments preferred.
• Hands-on proficiency with MFA, EDR, SIEM, vulnerability scanning, and patch management.
• Strong documentation and technical writing with attention to detail.

Responsibilities

• Design, deploy, and manage technical security controls for the compliance program.
• Maintain SSP/POA&M, system diagrams, and control evidence.
• Create and maintain security policies mapped to control families.
• Coordinate with external assessors and RPOs during CMMC processes.
• Run ongoing compliance activities: risk assessments, vulnerability management, and audit reviews.
• Support CMMC Level 2 certification and continuous monitoring.

Skills

Regulatory compliance

IT security

NIST SP 800-171

CMMC familiarity

Technical writing

Strong communicator

Education

Bachelor's degree in Information Technology/Cybersecurity/CS

Tools

EDR

SIEM

Vulnerability scanning tools

Patch management tooling

Job description

Fortem Technologies is the global leader in airspace security, delivering advanced solutions that protect against today’s autonomous aerial threats while ensuring the safety of tomorrow’s advanced air mobility. Fortem’s AI-powered SkyDome® Family of Systems combines TrueView™ sensors, command-and-control software, and autonomous DroneHunter® interceptors to defend military, government, and commercial operations worldwide from hostile or unauthorized drones. Fortem is the only company authorized to deploy a drone-on-drone kinetic interceptor in U.S. airspace, and its technology has been validated in operational deployments across Europe, the Middle East, and East Asia.

Headquartered in Lindon, Utah, Fortem is privately held and backed by Lockheed Martin, DCVC, Toshiba, AE Industrial Partners, AIM13, Signia Venture Partners, and others.

Position Overview

We are seeking an experienced IT Security Compliance Specialist to lead our organization's implementation, certification, and ongoing maintenance of Cybersecurity Maturity Model Certification (CMMC) Level 2 controls. This role owns the technical and administrative work required to protect Controlled Unclassified Information (CUI) in accordance with NIST SP 800-171, prepare the organization for its C3PAO assessment, and sustain continuous compliance across the contract lifecycle. The ideal candidate combines hands-on IT/security engineering skills with a strong understanding of DFARS 252.204-7012, CMMC assessment methodology, and federal contracting security requirements.

Key Responsibilities

Technical Security Controls & Infrastructure: Designing, deploying, and managing the technical backbone of the compliance program.

• Design, configure, and implement technical controls across access control, audit/accountability, configuration management, identification/authentication, incident response, media protection, physical security, risk assessment, system/communications protection, and system/information integrity domains.
• Deploy and manage supporting technologies: MFA, endpoint detection and response (EDR), SIEM/log management, data loss prevention, encryption (at rest and in transit), privileged access management, and network segmentation/enclaving for CUI.

Compliance Readiness & Regulatory Engagement: Maintaining the compliance ecosystem required to demonstrate and sustain compliance and staying current with evolving requirements.

• Maintain the System Security Plan (SSP), Plan of Action and Milestones (POA&M), Network/Data Flow Diagrams, and control implementation evidence.
• Author and maintain required policies and procedures (Incident Response Plan, Access Control Policy, Configuration Management Plan, etc.) mapped to each control family.
• Maintain a centralized compliance evidence repository sufficient to support a C3PAO assessment.
• Manage recurring compliance activities: annual affirmations, periodic risk assessments, vulnerability scanning/patching cadence, access reviews, and audit log reviews.
• Establish a continuous monitoring program to track control effectiveness, configuration drift, and emerging vulnerabilities; track and remediate assessment findings within required timeframes.
• Serve as the primary technical point of contact during the CMMC Level 2 Certification Assessment (C3PAO) or Self-Assessment, as applicable.
• Coordinate with external assessors, consultants, and Registered Practitioner Organizations (RPOs) as needed.
• Maintain compliance through system changes, new vendor/subcontractor relationships (flow-down requirements), and IT infrastructure updates.
• Monitor changes to CMMC/DFARS/NIST 800-171 requirements and update the compliance program accordingly.
• Develop and deliver security awareness and role-based training required under CMMC.
• Partner with HR/Legal on insider threat and personnel security requirements tied to CUI access.
• Partner with Procurement/IT vendors to ensure third-party services (cloud, MSP, SaaS) meet CMMC/FedRAMP requirements.

Other duties as required and assigned in line with IT Security Compliance.

Required Skills/Experience:

• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or equivalent experience.
• 3–5+ years of IT security/compliance experience, including direct experience with NIST SP 800-171, NIST SP 800-53, or CMMC frameworks.
• Working knowledge of DFARS 252.204-7012, FAR 52.204-21, and CUI handling requirements.
• Experience with Microsoft 365 GCC High, Azure Government, AWS GovCloud, or similar CUI-capable environments strongly preferred.
• Hands-on proficiency with core security tooling: MFA, EDR/antivirus, SIEM, vulnerability scanning, and patch management.
• Strong documentation and technical writing skills with high attention to detail; comfortable sustaining long-term, documentation-intensive compliance work.
• Analytical and solution-oriented; able to translate complex compliance requirements into actionable technical controls.
• Clear communicator capable of presenting technical and compliance concepts to non-technical stakeholders and senior leadership.
• Self-directed and organized; able to independently manage a long-term compliance program while balancing competing contract-driven deadlines.

Preferred Experience

• Prior role supporting a Defense Industrial Base (DIB) contractor through a CMMC Level 2 certification.
• Experience working with a C3PAO or RPO during a formal assessment.
• Familiarity with NIST SP 800-171A assessment procedures.

Fortem Technologies is proud to be an Equal Opportunity Employer. We are committed to building a team that represents a variety of backgrounds, perspectives, and skills. We do not discriminate against any employee or applicant on the basis of race, color, religion, sex (including pregnancy, sexual orientation, or gender identity), national origin, age, disability, genetic information, veteran status, or any other protected status under applicable laws. We believe that diversity drives innovation and makes us stronger.