Detailed understanding of Microsoft Azure, Microsoft Defender, Microsoft Sentinel, Microsoft 365 GCC/GCC High, and related Microsoft security technologies.
At least 6 years of cybersecurity experience with a strong focus on NIST SP 800-53 and/or NIST SP 800-171.
Experience supporting compliance assessments, audits, or certification activities.
Strong understanding of CMMC assessment methodology and evidence requirements.
Technical writing and communication skills.
Project management and organizational abilities.
Ability to manage multiple customer engagements simultaneously.
Experience working directly with external assessors, auditors, or regulatory bodies.
Familiarity with secure project management and compliance collaboration platforms.
Responsibilities
Maintain the master CMMC customer assessment schedule.
Coordinate assessment timelines with customers, C3PAOs, and internal SecureITSM teams.
Conduct readiness reviews and pre-assessment planning meetings.
Track customer assessment milestones, dependencies, and remediation activities.
Manage customer communications related to assessment preparation and scheduling.
Coordinate Rules of Engagement, assessment logistics, and secure evidence transfer processes.
Monitor assessment status and provide executive-level reporting on customer readiness.
Assist customers in understanding assessment scope, boundary definitions, and enclave considerations.
Maintain internal compliance documentation and evidentiary artifacts.
Coordinate annual evidence collection activities, including training certificates, access reviews, and vulnerability scans.
Assist with internal policy and procedure updates.
Support ongoing continuous monitoring and compliance validation activities.
Track changes to CMMC, NIST SP 800-171, and related Department of Defense guidance affecting internal compliance posture.
Maintain and update SecureITSM master implementation statement libraries aligned to NIST SP 800-171 and evolving CMMC guidance.
Develop and maintain industry-specific implementation statement sets for manufacturing, engineering, professional services, and telework-only environments.
Standardize implementation language and evidence expectations across customer environments.
Coordinate updates to implementation statements based on assessment findings, regulatory changes, and best practices.
Validate implementation statements for technical accuracy, completeness, and assessor defensibility.
Support continuous improvement of SecureITSM’s proprietary CMMC documentation platform and implementation content library.
Develop and maintain assessment preparation Standard Operating Procedures.
Continuously improve evidence collection and assessment support workflows.
Create standardized templates, checklists, and assessment playbooks.
Document lessons learned and incorporate process improvements.
Maintain internal knowledge base articles and operational documentation.
Assist in refining SecureITSM’s proprietary CMMC documentation platform workflows and processes.
Desired Qualifications
PMP certification.
CMMC Certified Professional or Certified Assessor certification.
CISSP, CISM, or an equivalent cybersecurity certification.
Experience supporting Department of Defense contractors or working within the Defense Industrial Base.
Familiarity with FedRAMP and DFARS 252.204-7012.
Experience with security information and event management, vulnerability management, and endpoint protection technologies.
About SecureITSM SecureITSM is a Certified CMMC Managed Service Provider (MSP) supporting Department of Defense (DoD) contractors that must obtain and maintain Cybersecurity Maturity Model Certification (CMMC). SecureITSM is a CMMC Certified Organization (CMMC UID #L200002160) and has developed a proprietary CMMC documentation and compliance platform designed to streamline assessment preparation, evidence management, and ongoing compliance operations.
We are seeking a highly organized and technically skilled CMMC Assessment Lead to oversee the planning, preparation, coordination, and support of customer CMMC assessments conducted by authorized C3PAOs. This role is critical to ensuring our customers successfully achieve and maintain compliance with NIST SP 800-171 Rev. 2 and future Rev. 3 requirements. The ideal candidate combines deep cybersecurity and compliance expertise with exceptional project management, customer communication, and assessment defense capabilities.
Location and Travel: This is a remote position with occasional travel required to support customer assessments.
Position Summary The CMMC Assessment Manager will oversee customer assessment readiness activities from initial scheduling through final assessment support and remediation coordination. The role requires direct interaction with customers, assessors, internal engineering teams, and executive leadership.
This individual will manage multiple concurrent customer engagements while ensuring assessment artifacts, implementation statements, policies, procedures, and evidentiary documentation are accurate, complete, and defensible.
Key Responsibilities Plan and Coordinate Assessments (Primary)
Maintain the master CMMC customer assessment schedule
Coordinate assessment timelines with customers, C3PAOs, and internal SecureITSM teams
Conduct readiness reviews and pre-assessment planning meetings
Track customer assessment milestones, dependencies, and remediation activities
Manage customer communications related to assessment preparation and scheduling
Coordinate Rules of Engagement (ROE), assessment logistics, and secure evidence transfer processes
Monitor assessment status and provide executive-level reporting on customer readiness
Assist customers in understanding assessment scope, boundary definitions, and enclave considerations
Support ongoing continuous monitoring and compliance validation activities
Track changes to CMMC, NIST SP 800-171, and related DoD guidance affecting internal compliance posture
Implementation Statement Management (Secondary)
Maintain and update SecureITSM master implementation statement libraries aligned to NIST SP 800-171 and evolving CMMC guidance
Develop and maintain industry-specific implementation statement sets (e.g., manufacturing, engineering, professional services, telework-only environments)
Standardize implementation language and evidence expectations across customer environments
Coordinate updates to implementation statements based on assessment findings, regulatory changes, and best practices
Validate implementation statements for technical accuracy, completeness, and assessor defensibility
Support continuous improvement of SecureITSM’s proprietary documentation platform and implementation content library
Maintain and Improve Standard Operating Procedures (Secondary)
Develop and maintain assessment preparation Standard Operating Procedures (SOPs)
Continuously improve evidence collection and assessment support workflows
Create standardized templates, checklists, and assessment playbooks
Document lessons learned and incorporate process improvements
Maintain internal knowledge base articles and operational documentation
Assist in refining SecureITSM’s proprietary CMMC documentation platform workflows and processes
Required Qualifications
U.S. Citizenship required
Detailed understanding of Microsoft Azure, Microsoft Defender, Microsoft Sentinel, Microsoft 365 GCC/GCC High, and related Microsoft security technologies
6+ years of cybersecurity experience with strong focus on NIST SP 800-53 and/or NIST SP 800-171
Experience supporting compliance assessments, audits, or certification activities
Strong understanding of CMMC assessment methodology and evidence requirements
Excellent technical writing and communication skills
Strong project management and organizational abilities
Exceptional attention to detail
Ability to manage multiple customer engagements simultaneously
Experience working directly with external assessors, auditors, or regulatory bodies
Familiarity with secure project management and compliance collaboration platforms
Preferred Qualifications
PMP certification preferred
CMMC Certified Professional (CCP) or Certified Assessor (CCA) preferred
CISSP, CISM, or equivalent cybersecurity certification preferred
Experience supporting DoD contractors or working within the Defense Industrial Base (DIB)
Familiarity with FedRAMP and DFARS 252.204-7012
Experience with SIEM, vulnerability management, and endpoint protection technologies
Key Attributes
Strong leadership and customer engagement skills
Ability to remain composed and professional during high-pressure assessment activities
Analytical thinker with strong problem-solving capabilities
Self-motivated with ability to work independently
Collaborative team player with strong interpersonal skills
High level of integrity and professionalism
All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, status as a protected veteran or any other basis prohibited by law.