IonQ - Senior Governance, Risk, and Compliance Engineer
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT
Requirements
• 5–8 years of professional experience in cybersecurity compliance, GRC, or security engineering, with demonstrated hands-on ownership of NIST SP 800-171 and CMMC compliance programs. • Proven track record developing SSPs, POA&Ms, and C3PAO assessment artifacts, and independently scoping CUI environments across realistic system boundaries. • Deep working knowledge of DFARS cybersecurity clauses (7012, 7019, 7020), CMMC 2.0 framework structure across all three levels, and the difference in assessment methodology between self-assessment and C3PAO. • A technical background in systems administration, cloud security, or security engineering sufficient to credibly lead control implementation discussions with IT and engineering teams, including network architecture, IAM, key management, logging, and endpoint management. • Experience leading cross-functional compliance initiatives and translating technical requirements for non-technical stakeholders including legal, finance, and executive leadership. • Bachelor’s degree in Computer Science, Information Security, or equivalent practical experience. • Familiarity with ITAR and EAR and how export control obligations intersect with CUI handling in a defense-adjacent research environment. • Hands-on experience with GRC platforms (e.g., Hyperproof, Drata, Anecdotes AI) and security tooling such as CSPM or vulnerability scanners. • Prior experience in a defense contractor, national laboratory, government, or high-security research environment. • CMMC certifications (CCP, CCA, or LCPA) are a strong plus, as are CISSP, CISM, CISA, or CRISC. • The approximate base salary range for this position is $110,336 - $144,459. The total compensation package includes base, bonus, equity, and a range of benefit options found on our career site. • Compensation will vary based on individual factors such as education, qualifications, and experience of the final candidate(s), specific office location, and calibration against relevant market data and internal team equity. Posted base salary figures are subject to change as new market data becomes available. Our benefits include comprehensive medical, dental, and vision plans, matching 401K, unlimited PTO and paid holidays, parental/adoption leave, legal insurance, and a home technology stipend. Details of participation in these benefit plans will be provided when a candidate receives an offer of employment.
Responsibilities
• Architect and own end-to-end CMMC implementation and audit readiness, including scoping strategy, control mapping, SSP and POA&M development, evidence collection, and remediation tracking across the organization. • Interpret and apply DFARS clause requirements, including DFARS 252.204-7012, 252.204-7019, and 252.204-7020, translating contractual obligations into operational controls and owning accurate SPRS submissions. • Lead recurring internal audits of NIST 800-171 security controls and drive end-to-end preparation for C3PAO assessments, including evidence packages, assessment logistics, and assessor coordination. • Architect CUI environments to meet CMMC boundary requirements, including network segmentation, access control, media protection, and FIPS-validated encryption; lead evaluation of cloud environments against CMMC scoping guidance. • Drive implementation of technical controls across NIST 800-171 practice families, including MFA, audit logging, configuration management, incident response, and vulnerability management, engaging directly with engineering teams. • Serve as the primary CMMC subject matter expert at IonQ, developing compliance roadmaps, facilitating readiness workshops, and providing authoritative guidance on DFARS flow-down requirements for subcontractors. • Partner with legal and contracts teams to review FAR/DFARS clauses in new and existing contracts, flagging CUI obligations and CMMC level requirements, and lead coordination with regulatory teams on ITAR and EAR obligations as they intersect with CUI handling. • Develop and operate a formal risk management program covering IT systems and infrastructure, maintain a risk register, and provide regular executive-level reporting on posture, open risks, and remediation progress. • Own and mature the organization’s GRC platform to support evidence management, POA&M tracking, and risk register maintenance, and build compliance dashboards for leadership visibility.
No credit card. Takes 10 seconds.