Defense Unicorns - Compliance Lead - CMMC (NIST SP 800-171)

• The listed responsibilities are not exhaustive and additional responsibilities may be assigned based on the evolving needs of the organization. We are seeking a dynamic individual who is able to adapt and take on new responsibilities as they arise. • Serve as the primary point of contact for assigned customers for the life of the engagement: run kickoff, working sessions, and status reporting; answer CMMC and NIST SP 800-171 questions directly and accurately without escalation. • Scope the CMMC assessment boundary: trace FCI and CUI flows, categorize assets per the CMMC Level 2 Scoping Guide (CUI, Security Protection, Contractor Risk Managed, Specialized, Out of Scope), and produce the boundary, data-flow, and network diagrams. • Lead each engagement through the standard delivery process from intake to assessor-ready package, holding the stage gates and evidence standards. • Author and maintain the System Security Plan, policies and procedures, POA&M, and evidence library at the assessment-objective level; score self-assessments and SPRS submissions under the DoD Assessment Methodology and 32 CFR Part 170. • Implement the technical controls hands-on in the customer tenant: identity, MFA, and conditional access in Entra ID or Google Cloud Identity; least privilege and privileged-account separation; data protection in Microsoft Purview or Google Workspace DLP; FIPS-validated encryption; configuration baselines. Decide which requirement each setting satisfies and why, and split the heavier build work with the Technical Implementation Engineer. • Stand up and operate endpoint management across Windows, macOS, iOS, and Android with Microsoft Intune and Jamf (Apple Business Manager, Android Enterprise): enrollment, compliance policies, CIS or DISA STIG baselines, BitLocker and FileVault, patching, and removable-media control. • Build the logging and monitoring stack the AU, RA, and SI practices require: centralized audit logging and alerting in a SIEM (Microsoft Sentinel, Google SecOps, Splunk, or similar), log retention and review cadence, vulnerability scanning and remediation tracking, and backup and recovery verification. • Assess the finished environment against the CMMC Level 2 Assessment Guide using examine, interview, and test methods; run the pre-assessment readiness review and close gaps before the C3PAO arrives. • Prepare customers for C3PAO assessments and support them during assessment week: evidence presentation, interview coaching, assessor questions, and post-assessment POA&M closeout. • Run sustainment for customers: continuous monitoring cadence, change reviews, annual affirmations, and reassessment readiness. • Improve the practice: turn repeatable work into templates, checklists, and automation, and contribute domain content to the team's internal AI tooling.