CMMC Compliance Manager

The CMMC Compliance Manager guides Cuick Trac® clients through implementing and maintaining every customer-responsible control in their environment, and prepares and supports them through third-party (C3PAO) assessments where required. You will be the client's trusted advisor from onboarding through certification and beyond: translating the Customer Responsibility Matrix into a practical action plan, building the documentation assessors expect, and keeping clients compliant as their business, contracts, and the regulations evolve. The ideal candidate has hands-on experience with NIST SP 800-171, CMMC, and the current DFARS cybersecurity clauses as they apply to Controlled Unclassified Information (CUI), Covered Defense Information (CDI), Controlled Technical Information (CTI), and export-controlled data (ITAR/EAR). Key Responsibilities - Customer-responsible control implementation - Walk each client through the Cuick Trac Customer Responsibility Matrix, clearly separating inherited, shared, and customer-responsible controls. - Create and validate client-specific inheritance and responsibility documentation. - Provide remediation guidance so clients fully implement their customer-responsible NIST SP 800-171 / CMMC Level 2 requirements, including: - Boundary and scoping diagrams (CUI, Security Protection, Contractor Risk Managed, and Out-of-Scope assets) - Data and user flow diagrams and data management plans - Incident response plans and tabletop testing exercises - Physical security remediation advisory - Policies and procedures, reviewed or written from scratch - Assessment readiness and documentation - Perform gap assessments, risk assessments, and implementation reviews against NIST SP 800-171A objectives. - Develop and maintain the System Security Plan (SSP) and Plan of Action and Milestones (POA&M), including tracking POA&M closeout within required timeframes. - Advise clients on CMMC status entries and annual affirmations in SPRS. - Third-party assessment support - Prepare clients for CMMC Level 2 C3PAO assessments and, where applicable, DCMA DIBCAC Medium and High assessments. - Assemble evidence packages and coach client personnel for assessor interviews and demonstrations. - Support clients during assessments and guide remediation of any findings. - Ongoing compliance - Conduct annual compliance reviews to keep clients assessment-ready between certifications. - Review government contracts and solicitations for cybersecurity, CUI, and export-control requirements, recognizing both current and legacy clause numbers. - Build and manage compliance roadmaps based on existing and emerging cybersecurity standards. - Administer the Governance, Risk, and Compliance (GRC) tool for assigned clients. - Other duties as assigned based on business needs. Required Skills & Experience - 2–4 years of customer-facing experience with NIST SP 800-171, NIST SP 800-53, CMMC, and the NIST Risk Management Framework. - Working knowledge of the DoD cybersecurity clauses as realigned on February 1, 2026 under the Revolutionary FAR Overhaul - class deviations: DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting - DFARS 252.204-7021, Contractor Compliance with the CMMC Level Requirements, and provision 252.204-7025, Notice of CMMC Level Requirements - DFARS 252.240-7997, NIST SP 800-171 DoD Assessment Requirements (formerly 252.204-7020) - FAR 52.240-93, Basic Safeguarding of Covered Contractor Information Systems (formerly 52.204-21) - Awareness that legacy contracts may still cite 252.204-7019 and 252.204-7020 - Familiarity with the CMMC program rule (32 CFR Part 170), including scoping, POA&M, and affirmation requirements - Experience with firewalls, SIEM, vulnerability management, MFA, endpoint protection, DLP, and other security tools - Experience with risk and security assessment processes, and with tracking and remediating findings from audits or assessments - POA&M management - Knowledge of DoD cybersecurity policy, governance best practices, and emerging trends - Working knowledge of operating systems, security applications, and basic network protocols, tools, and infrastructure - Strong written and verbal communication; able to explain technical requirements to non-technical business owners - Strong project management skills, with the ability to run multiple client engagements at once - This includes planning timelines and milestones, prioritizing competing deadlines, tracking deliverables, and keeping each client informed of status and next steps - Consultative client management: delivers difficult findings with tact, builds trust, and handles pushback while keeping the client relationship strong - Teaching and coaching: helps client personnel understand and take ownership of their customer-responsible controls, and prepares them to answer assessor questions on their own - Exceptional attention to detail: keeps SSPs, diagrams, evidence, and other documentation accurate and consistent with each other - Microsoft Office / Microsoft 365 - Occasional travel may be required Preferred Skills & Experience - Incident response planning and tabletop exercises: writing and updating incident response plans, and designing and facilitating tabletop exercises that test clients' detection, escalation, and reporting procedures, including DoD's 72-hour cyber incident reporting requirement - Familiarity with emerging and upcoming compliance requirements, and the ability to help clients prepare for them: - NIST SP 800-171 Revision 3 - The FAR Controlled Unclassified Information (CUI) rule - The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Preferred Certifications The following are representative of the certifications we value: - CMMC Certified Professional (CCP) - CMMC Certified Assessor (CCA) - CMMC Registered Practitioner (RP / RPA) - CISSP - CISM - CISA - ISO/IEC 27001 Lead Auditor - Microsoft Azure certifications Eligibility Because this position may require access to export-controlled information, candidates must meet applicable U.S. person requirements under relevant export-control regulations, including U.S. citizens, lawful permanent residents, and other qualifying protected individuals as defined under 8 U.S.C 1324b (a)(3). Work Location This is a remote position.