Job Description
Job Description RESPONSIBILITIES
Compliance program operation
- Track all 110 NIST SP 800-171 requirements across the 14 control families; keep the SPRS score current and defensible.
- Maintain the SSP, POA&M, and supporting documents: policies, procedures, data flow diagrams, asset inventories.
- Run internal 800-171A and gap assessments; propose remediation owners and dates; track findings to closure.
- Verify controls technically: run 800-171A objectives as tests against the systems (MFA enforcement, session lock, audit retention, encryption), not as document review.
- Keep an audit-ready evidence repository mapped to controls that an assessor can follow without coaching; build repeatable collection with scripts, saved queries, and scheduled exports.
- Prepare the annual Affirming Official affirmation package; support DFARS 7012, DIBCAC, and CMMC Level 2 assessments.
Risk management
- Maintain the security risk register; translate technical findings into likelihood, impact, and options leadership can act on.
- Fold CISA and DoD threat advisories into the risk picture.
- Flag boundary changes (new CUI contract, new system, enclave change); draft risk acceptances for sign-off.
Legal and contract liaison
- Review contracts and flowdowns for CUI, ITAR, NNPI, and cybersecurity obligations; define the controls and evidence needed.
- Act as point of contact for Legal and Contracts: answer can we truthfully attest to this? with control status and evidence.
- Coordinate supplier security reviews where CUI or export-controlled data flows down; track flowdown compliance.
- Escalate any gap that creates legal or contractual exposure to the Cybersecurity Manager and Legal, in writing.
- Support voluntary disclosure and incident reporting with timeline reconstruction, evidence collection, and documentation.
Policy, training, monitoring, and reporting
- Write and maintain policies, SOPs, and control narratives in SRC house style; update on DoD, DFARS, or NIST changes and record why.
- Deliver security awareness and role-based training; track completion across the workforce.
- Triage SIEM alerts for the CUI enclave, tune noisy rules, compare deployed configurations to CIS or STIG baselines, and open remediation items.
- Administer the vulnerability scanner, SIEM rule content, and the GRC and evidence tooling.
- Support incident response evidence and timelines, including DFARS 7012 reporting to DoD when CUI is involved.
- Report control status, open risks, and remediation progress on a set cadence; produce readiness summaries on request.
QUALIFICATIONS
Required
- 3 to 5 years in cybersecurity, with a background in systems administration, security operations, or security engineering before or alongside compliance work.
- Working knowledge of NIST SP 800-171 and DFARS 252.204-7012.
- Built or maintained an SSP and POA&M; maps controls to evidence.
- Can pull the configuration, log, or report that proves a control is implemented in Entra ID, Intune, Windows, and firewalls, and explain what it shows.
- Basic PowerShell or Python for exporting evidence (MFA status, patch compliance, account inventories) rather than assembling screenshots by hand.
- Working knowledge of Windows and Microsoft 365 administration, Active Directory and Entra ID, and network fundamentals: VLANs, firewall rules, remote access.
- Strong policy writing; explains controls to non-technical owners.
- Bachelor's in cybersecurity or IT, or equivalent experience.
- U.S. Person status under ITAR (22 CFR 120.62), given access to export-controlled technical data. Preferred
- Prior help desk, systems administration, or SOC time.
- Azure Government or GCC High administration; Palo Alto or equivalent firewall exposure; STIG or CIS benchmark work.
- Exposure to CMMC Level 2 readiness, SPRS scoring, or a prior C3PAO or DIBCAC assessment.
- Experience with Legal or Contracts on clause interpretation, flowdown, or disclosure obligations.
- Experience with a manufacturing environment and operational technology (OT).
- Familiarity with ITAR and NNPI handling requirements.
- Hands-on time with a GRC or compliance tracking tool, and with Jira or Jira Service Management.
- Security+, CySA+, SC-200, AZ-500 or SC-300, CISSP.
Job Tags
Contract work, Remote work