Compliance Lead (CMMC)

Location: Remote - USA; 10%–25% travel for customer kickoffs, on-site readiness reviews, and C3PAO assessment weeks.

Salary: $123,250–$166,750 USD annually; compensation ranges apply across all geographic locations within the United States.

Company

hirify.global delivers secure, cloud-native software solutions, continuous integration and delivery, security pipelines, testing, and deployment automation for defense, civil agencies, and enterprise customers.

What you will do

• Serve as the primary customer-facing lead across CMMC engagements, from kickoff and working sessions through assessment support and sustainment.
• Scope CMMC assessment boundaries by tracing FCI and CUI flows, categorizing assets, and producing boundary, data-flow, and network diagrams.
• Author System Security Plans, policies, procedures, POA&Ms, evidence libraries, self-assessments, and SPRS submissions at the assessment-objective level.
• Implement and validate identity, MFA, conditional access, least privilege, DLP, encryption, endpoint, logging, monitoring, vulnerability-management, and backup controls across customer environments.
• Assess environments using CMMC Level 2 examine, interview, and test methods; prepare customers for C3PAO assessments and close post-assessment gaps.
• Improve delivery through reusable templates, checklists, automation, and domain content for internal AI tooling while managing 4–6 concurrent engagements.

Requirements

• Experience taking defense contractors through NIST SP 800-171 and CMMC Level 2 end to end, including at least one organization personally led through a successful C3PAO or DIBCAC assessment as a consultant, assessor, or internal compliance lead.
• Ability to write assessor-ready System Security Plans at the assessment-objective level, policies and procedures, POA&Ms, and data-flow and network diagrams.
• Hands-on implementation of NIST SP 800-171 controls in Microsoft 365 GCC High or Google Workspace, including administration-console work and validation of implementations.
• Endpoint management across Windows and macOS using Microsoft Intune or Jamf, including enrollment, compliance and configuration policies, disk encryption, patching, and hardening baselines.
• Experience centralizing audit logs and alerts in Microsoft Sentinel, Google SecOps, Splunk, or a similar platform, plus vulnerability scanning, patch management, and backup operations.
• Working knowledge of firewalls, VPN and secure remote access, segmentation, DNS, and wireless networking sufficient to scope boundaries and verify SC practices.
• Customer-facing leadership skills, including running meetings, explaining requirements to executives and IT staff, documenting decisions, pushing back constructively, and working without close supervision.
• Ability to manage multiple concurrent engagements, typically 4–6, track milestones, and report status in a remote asynchronous environment using Slack, Notion, and Google Workspace.

Nice to have

• CMMC Certified Assessor (CCA) strongly preferred; CMMC Certified Professional (CCP) required at minimum. Lead CCA or Registered Practitioner Advanced (RPA) is a plus.
• Hands-on experience with both Google Workspace and Microsoft 365 GCC High, including GCC High migrations and Google Workspace configurations built to NIST SP 800-171.
• Experience with Apple Business Manager, Android Enterprise, Microsoft Defender for Endpoint, Microsoft Purview, Microsoft Sentinel, Google SecOps, CIS Benchmarks, DISA STIG hardening, Windows Server, or Active Directory in hybrid environments.
• Experience designing and migrating CUI enclaves using GCC High, Azure Government, AWS GovCloud, or on-premises environments, including FedRAMP Moderate equivalency evaluation and external service-provider scoping.

Culture & Benefits

• Full-time employment with flexible time off, federal holidays, one week for Thanksgiving, and two weeks for Christmas and New Year’s.
• Medical, dental, and vision coverage with premiums fully paid by the company, plus an HSA, life insurance, and disability insurance.
• 401(k) retirement plan, company stock options, and a home-office budget.
• Paid parental leave and reimbursement for approved training, subscriptions, and conference attendance.
• Work focuses on secure software delivery, Kubernetes, cloud environments, infrastructure as code, GitOps, containers, CNCF projects, and cloud-native applications.