Virtual Chief Information Security Officer (vCISO) – CMMC Compliance

Covenant HR; Corona (CA); Remote; USD 96,000 - 179,000; Full time

Job summary

Covenant HR LLC is seeking a vCISO (Contract to Hire) for Southern California. Initial remote work with transition to hybrid in Corona, CA; must reside within commuting distance. The role focuses on strategic cybersecurity, governance, risk, and compliance for manufacturing clients.

You will lead CMMC Level 2 and NIST 800-171 initiatives, develop security policies, and manage multiple client engagements with a remote-first approach and occasional client-site visits.

Qualifications

• CCP with hands-on NIST 800-171 and CMMC Level 2 experience.
• Experience supporting manufacturing clients in cybersecurity and compliance.
• Hands-on with GRC platforms (ControlMap, IntelliGRC, FutureFeed, Vanta).

Responsibilities

• Serve as a trusted vCISO, guiding cybersecurity, governance, risk and compliance for multiple clients.
• Lead CMMC Level 2 and NIST 800-171 compliance programs, gap assessments and remediation.
• Develop and maintain cybersecurity policies and governance frameworks for clients.
• Use GRC tools to track controls, remediation, and audit readiness.

Skills

Certified CMMC Professional (CCP)

NIST 800-171

CMMC Level 2

GRC platforms (ControlMap)

GRC platforms (IntelliGRC)

GRC platforms (FutureFeed)

GRC platforms (Vanta)

EDR

RMM

ZTNA

Client relationship management

Strong communication

Tools

ControlMap

IntelliGRC

FutureFeed

Vanta

EDR

RMM

ZTNA

Job description

Company - Our client is a rapidly growing cybersecurity and compliance services firm specializing in helping organizations navigate complex regulatory requirements and strengthen their security programs. This entrepreneurial organization offers an opportunity to make an immediate impact, shape service delivery, and grow into senior leadership as the business expands.

Job Title - vCISO (CMMC)

Location - Southern California (Initially remote, transitioning to hybrid in Corona, CA once the office is established). Must reside within commuting distance of Corona.

Role Type - Contract to Hire (6-month contract with intent to convert to full-time employment)

Must Have Skills:

• Certified CMMC Professional (CCP) with deep, hands-on experience implementing and managing NIST 800-171 and CMMC Level 2 compliance requirements.
• Prior cybersecurity and compliance experience supporting manufacturing organizations.
• Hands-on experience with GRC platforms such as ControlMap, IntelliGRC, FutureFeed, Vanta, or similar solutions.
• Familiarity with MSP security technologies, including Endpoint Detection and Response (EDR), Remote Monitoring and Management (RMM), Zero Trust Network Access (ZTNA), and related security tools.
• Exceptional communication, interpersonal, and client relationship management skills, with the ability to independently manage multiple client accounts in a fast-growing environment.

Responsibilities and Job Details:

• Serve as a trusted virtual Chief Information Security Officer (vCISO), providing strategic cybersecurity, governance, risk, and compliance guidance to multiple client organizations.
• Lead CMMC Level 2 and NIST 800-171 compliance initiatives, including gap assessments, remediation planning, implementation, and ongoing compliance management.
• Develop, implement, and maintain cybersecurity policies, procedures, controls, and governance frameworks tailored to client environments.
• Leverage GRC platforms to manage compliance programs, track remediation activities, document controls, and support audit readiness.
• Advise manufacturing clients on cybersecurity best practices, regulatory requirements, and risk mitigation strategies.
• Collaborate with technical teams to align security solutions, including EDR, RMM, and ZTNA technologies, with client compliance objectives.
• Independently manage multiple client engagements, maintaining strong relationships and delivering consistent, high-quality service.
• Conduct security assessments, identify compliance gaps, and provide actionable recommendations to strengthen clients' cybersecurity postures.
• Partner with internal leadership to enhance service delivery, develop scalable processes, and support the organization's continued growth.
• Participate in occasional client-site visits while maintaining a primarily remote work arrangement until the transition to hybrid.

Nice to Have:

• Experience architecting and developing cybersecurity programs for defense industry clients, as well as prior experience working within an MSP environment.
• Join a collaborative, entrepreneurial team with significant opportunities for professional development, increasing ownership, and potential advancement into senior leadership or executive roles.