Security Governance, Risk & Compliance·Posted on Nov 9·
Full-timeReston, VA, USA$125k - $140k /yr
About the Job
Requirements
Present proof of U.S. citizenship before hire.
Have at least 5 years of experience in the Defense Industrial Base as a compliance manager or in a related position.
Possess a strong technical background and understanding of how NIST controls work, not just what they require.
Hold a CMMC RP, CCP, or CCA certification.
Have worked for or with a managed service provider and a C3PAO.
Work well as part of a team and maintain motivation when working individually.
Be comfortable speaking or presenting to clients and team members.
Possess professional-level verbal and written communication skills.
Be familiar with the NIST Risk Management Framework and CMMC compliance.
Responsibilities
Lead, mentor, and develop a team of analysts through NIST 800-171a gap assessment and remediation projects, including setting priorities, assigning work, and providing regular feedback.
Participate in hiring, onboarding, and training new analysts on ISI’s assessment methods and tools.
Conduct performance reviews and support analysts’ professional development, including CMMC certification paths (CCP/CCA).
Balance team workload across concurrent client engagements to meet deadlines while maintaining quality.
Own quality control for compliance deliverables, including SSPs, POA&Ms, policies, and evidence packages, by reviewing them before they are sent to clients or C3PAOs.
Build and maintain standard templates, checklists, and playbooks so assessments are consistent and repeatable across clients.
Track engagement progress against timelines and budgets and escalate risks to leadership early.
Act as the primary compliance point of contact for assigned clients, setting expectations and managing escalations.
Report team metrics and client status to leadership, including SPRS score progress, open POA&M items, and audit readiness.
Monitor changes to CMMC, DFARS, and NIST guidance, and update team processes and client guidance accordingly.
Gather lessons learned from C3PAO audits and incorporate them into ISI’s methods and training.
Work directly with client stakeholders throughout onboarding and compliance gap assessments.
Review client environments and collect evidence to determine whether CMMC/NIST controls are satisfied.
Assist clients in formulating a compliant set of policies and procedures.
Complete compliance assessment documentation, including Network Design Documents and Software Whitelists.
Recommend solutions to remediate identified compliance gaps.
Work with Cybersecurity, Engineering, and Support departments to ensure configurations are completed and tested in a compliant manner.
Generate POA&M documents for remediation of identified gaps.
Generate SSP documents reflecting deployed tools and assessment results.
Interface directly with and lead discussions with C3PAO auditors during CMMC Level 2 audits.
Desired Qualifications
Be detail-oriented, process-driven, and well organized.
Be a self-starter who looks for ways to help.
ISI Enterprises is searching for individuals with a strong technical background to join our team as CMMC/NIST 800-171a Compliance Manager. ISI Enterprises is a Managed Network Services provider focusing on US Government contractors who have a need to achieve CMMC compliance.
Duties/Responsibilities:
Team Leadership
Lead, mentor and develop a team of analysts manage a team of analysts through NIST 800-171a gap assessment and remediation projects. Including setting priorities, assigning work, and providing regular feedback.
Participate in hiring, onboarding, and training new analysts on ISI’s assessment methods and tools.
Conduct performance reviews and support analysts’ professional development, including CMMC certification paths (CCP/CCA).
Balance team workload across concurrent client engagements to meet deadlines without sacrificing quality.
Delivery and quality
Own quality control for all compliance deliverables (SSPs, POA&Ms, policies, evidence packages), reviewing them before they go to clients or C3PAOs.
Build and maintain standard templates, checklists, and playbooks so assessments are consistent and repeatable across clients.
Track engagement progress against timelines and budgets, and escalate risks to leadership early.
Client and business ownership
Act as the primary compliance point of contact for assigned clients, setting expectations and managing escalations.
Report on team metrics and client status to leadership, such as SPRS score progress, open POA&M items, and audit readiness.
Continuous improvement
Monitor changes to CMMC, DFARS, and NIST guidance, and update team processes and client guidance accordingly.
Gather lessons learned from C3PAO audits and feed them back into ISI’s methods and training.
Client Lifecycle Duties/Responsibilities:
Work directly with ISI Enterprises client stakeholders throughout their onboarding and compliance gap assessment.
Review client environments and collect evidence to determine the satisfaction of CMMC/NIST controls.
Assist clients in the formulation of a compliant set of policies and procedures.
Complete documentation required for a compliance assessment (Network Design Documents, Software Whitelist, etc)
Recommend solutions to remediate identified gaps in compliance.
Work directly with our Cybersecurity, Engineering, and Support departments to ensure all configurations are completed and tested in a compliant manner.
Generate POAM’s (Plan of Action and Milestone) documents for the remediation of found gaps
Generate SSP (System Security Plan) documents to reflect deployed tools and assessment results
Interface directly and lead discussions with C3PAO auditors during CMMC Level 2 Audits
Qualifications:
As part of your work at ISI, you will potentially have access to sensitive information from the federal government. Pursuant to applicable regulations, ISI requires that all candidates for this role present proof of U.S. citizenship before hire.
Have at least 5 years of experience in the Defense Industrial Base as a compliance manager or related position.
Possess a strong technical background and understanding of the “How” for NIST controls and not just the “What”.
Must hold a CMMC RP, CCP or CCA certification.
Be detail oriented, process driven, and well organized.
Have worked for or with an MSP (Managed Service Provider) and C3PAO.
Work Well as a team, but also able to maintain motivation when working individually.
Be comfortable speaking and/or presenting to clients and team members
Have professional level verbal and written communications skills.
Possess a familiarity with NIST Risk Management Framework and CMMC compliance.
Be a self-starter, someone who is always looking to see where they can help.
What we offer:
The salary range for this role is $125,000- $140,000 commensurate with experience
Opportunity for hybrid work
A competitive salary and benefits package
A casual, friendly, and relaxed work environment
Professional growth encouragement and support
Industrial Security Integrators, LLC (“IsI”) is an equal opportunity employer committed to affirmative action and diversity in the workplace. It is the policy of IsI to provide Equal Employment Opportunities (EEO) to Employees and Applicants, without regard to race, color, religion, sex, age, marital status, citizenship status, national origin, sexual orientation, gender identity, veteran status or disability or any other factor protected by law and to provide advancement opportunities for minorities, women, disabled individuals, and veterans. IsI is stronger and more effective when our workforce includes highly qualified individuals with diverse backgrounds, cultures, and traditions.
IsI Enterprises does not accept unsolicited resumes from individual recruiters or third-party recruiting agencies in response to job postings or otherwise. Placement fees will not be paid to any recruiter unless IsI has an active agreement in place with the recruiter and such a request has been made by the IsI hiring team and such candidate was submitted to the IsI hiring team via our Applicant Tracking System. Any unsolicited resumes or other data submitted to IsI in violation of this policy may be used by IsI without obligation to pay any fees of any kind to the recruiter.