CMMC Compliance Lead (Remote - US only)

A US-based company that builds secure software delivery solutions for federal and commercial customers is hiring a customer-facing lead for CMMC Level 1 and Level 2 engagements. The role owns NIST SP 800-171 interpretation, assessment boundary scoping, documentation, and assessment readiness from kickoff through the C3PAO assessment and into ongoing sustainment. The person in this role is expected to configure controls hands-on and to verify results the way an assessor would. Travel of 10%-25% is expected for customer kickoffs, on-site readiness reviews, and assessment weeks.

What you'll do

• Act as the primary day-to-day contact for assigned customers, running kickoffs, working sessions, and status reporting, and answering CMMC and NIST SP 800-171 questions accurately.
• Scope the assessment boundary by tracing FCI and CUI flows, categorizing assets under the CMMC Level 2 Scoping Guide, and producing boundary, data-flow, and network diagrams.
• Write and maintain the System Security Plan, policies, POA&M, and evidence library; score self-assessments and SPRS submissions under the DoD Assessment Methodology.
• Implement identity, MFA, conditional access, least-privilege, data protection, and encryption controls directly in customer Microsoft 365 GCC High or Google Workspace tenants.
• Manage endpoint configuration across Windows and macOS with Microsoft Intune or Jamf, including disk encryption, compliance policies, patching, and hardening baselines.
• Assess the finished environment against the CMMC Level 2 Assessment Guide, close gaps before the assessor arrives, and support customers through assessment week and sustainment cycles.

What you need

• Hands-on experience taking defense contractors through NIST SP 800-171 or CMMC Level 2 from scoping through a C3PAO or DIBCAC assessment, in a consultant, assessor, or internal lead role.
• Proven ability to write assessor-ready documentation, including SSPs at the assessment-objective level, policies, POA&Ms, and diagrams.
• Direct admin-console experience with GCC High (Entra ID, Intune, Purview, Defender) or Google Workspace (Admin console, Cloud Identity, context-aware access).
• Endpoint management experience on Windows and macOS with Intune or Jamf, plus working knowledge of SIEM/log platforms, vulnerability management, backup, and network perimeter controls.
• Strong plain-language communication with executives and IT staff, and ability to manage 4-6 concurrent engagements in an asynchronous remote setting.
• Must be located in the United States. CMMC Certified Professional (CCP) or Certified Assessor (CCA) credentials are strongly preferred.

Applicants must be based in: United States.

How to apply

Get the free i'llTip app to see the employer's details and apply. i'llTip's AI can tailor your résumé to this job, and you'll get alerts for similar roles.

Prefer the website? Continue on illtip.comOr get the app: Android · iPhone

🔔 Get new jobs like this first: join i'llTip Jobs on Telegram · or get personal job alerts