Implementation Specialist - CMMC

About Secureframe

Secureframe helps organizations build, automate, and prove trust through modern security, compliance, and risk programs. Our platform helps customers manage evidence, policies, controls, vendors, personnel, assets, and audit readiness across frameworks including SOC 2, ISO 27001, NIST 800-171, and CMMC.

We are expanding deeper into the defense industrial base with our CMMC product. For many customers, CMMC is not just a compliance requirement. It is the path to winning or retaining contracts with the Department of Defense, primes, aerospace and defense companies, government agencies, and regulated commercial buyers. Our opportunity is to make CMMC implementation faster, clearer, and more operational for companies that cannot afford to turn a lean team into a full-time compliance department.

About the Implementation Team

The Implementation team sits within Secureframe's customer organization and works closely with Sales, Customer Success, Product, Engineering, Security, Support, and our partner ecosystem. This team is responsible for helping customers move from signed contract to real operational readiness: scoped environments, configured platform workflows, clear control ownership, evidence collection, remediation tracking, and a credible path to CMMC assessment.

This is an early role on a team we are building from scratch. The right person is not only comfortable delivering customer implementations; they want to help define what excellent CMMC implementation looks like at Secureframe. You will create playbooks, improve handoffs, identify repeatable delivery patterns, pressure-test service packaging, and help turn early customer engagements into a scalable implementation motion.

About the Role

As an Implementation Specialist focused on CMMC, you will lead customer implementations and deliver hands-on technical remediation for defense customers preparing for CMMC Level 2 assessments. You will configure and administer Microsoft 365 GCC High and Azure Government environments, implement and validate security controls, and help customers develop the documentation and evidence needed for assessment readiness.

This customer-facing role combines project leadership, Microsoft systems administration, security engineering, and CMMC expertise. You will serve as the primary implementation owner, manage multiple engagements, troubleshoot technical issues, and translate compliance requirements into working configurations and repeatable operating procedures. You will execute technical work within the agreed scope and coordinate with customer IT teams and external partners on shared responsibilities and specialized remediation.

What You'll Do

• Lead end-to-end CMMC implementations from discovery and scoping through environment configuration, control validation, documentation, readiness milestones, and operational handoff.

• Translate customer requirements into implementation plans with clear scope, timelines, milestones, owners, risks, dependencies, and success criteria; communicate progress and drive accountability across multiple engagements.

• Translate CMMC Level 2 and applicable NIST SP 800-171 requirements into implementation tasks, identify control gaps, and execute remediation. Help customers operationalize CUI and FCI handling, asset categorization, evidence collection, and assessment preparation.

• Map where controlled unclassified information (CUI) and federal contract information (FCI) live across email, file sharing, cloud applications, endpoints, engineering systems, specialized equipment, facilities, and third-party providers; document system boundaries and control ownership.

• Configure Secureframe workflows for control mapping, evidence automation, policies, procedures, owner assignments, remediation tracking, and readiness reporting. Document technical configurations and control evidence, and contribute to System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), and assessment preparation.

• Provision, harden, and administer Microsoft 365 GCC High tenants and Azure Government resources, including virtual machines, storage, Azure Virtual Desktop, backups, and monitoring.

• Configure Microsoft Entra ID, Conditional Access, multifactor authentication, role-based access, and Privileged Identity Management. Administer Windows Server, Active Directory Domain Services, Group Policy, DNS, and hybrid identity synchronization; configure Microsoft Entra Domain Services where appropriate.

• Deploy and manage Microsoft Intune for device enrollment, configuration profiles, security baselines, endpoint compliance, encryption, application deployment, and patching.

• Implement Microsoft Sentinel data connectors, log collection, analytics rules, dashboards, alert tuning, and incident-response automation.

• Configure Microsoft Defender and Purview for endpoint protection, vulnerability management, data loss prevention, sensitivity labeling, and protection of CUI.

• Support secure network configurations and coordinate firewall, VPN, segmentation, and connectivity changes with customer IT teams and partners. Bridge on-premises infrastructure with GCC High, Azure Government, and secure enclaves, including hybrid identity, controlled data flows, access boundaries, and connectivity validation. Account for physical controls and non-Microsoft systems, including Google Workspace, where relevant to customer scope.

• Work with Sales and Customer Success to improve pre-sale scoping, implementation estimates, customer expectation-setting, and handoff quality.

• Provide advisory support on CMMC scope, secure architecture, control gaps, and remediation priorities, translating technical and compliance tradeoffs into practical recommendations for customer stakeholders.

• Collaborate with CMMC partners, MSPs, consultants, auditors, and C3PAOs while maintaining clear boundaries around Secureframe's role in preparation, platform tooling, implementation support, and independent assessment.

• Deliver customer training and technical working sessions that help administrators operate their environments, troubleshoot issues, assign control owners, collect evidence, and maintain readiness. Provide documented procedures and an operational handoff to customer teams and Customer Success.

• Build repeatable implementation assets, including kickoff templates, project plans, RACI models, discovery questionnaires, evidence checklists, status reports, readiness criteria, risk registers, and handoff runbooks.

• Identify patterns across implementations and feed those insights back to Product, Engineering, Sales, Customer Success, and leadership.

• Automate deployment, administration, configuration, and evidence collection using PowerShell, Microsoft Graph, and Azure tooling. Use AI and automation thoughtfully to streamline repeatable delivery work, surface risks, and improve time to value.

What Success Looks Like

• Customers know exactly what they need to do, who owns each workstream, and how Secureframe supports their path to readiness.

• Customers have scoped environments, configured and validated controls, documented procedures, assigned evidence owners, and clear remediation plans. Administrators can operate the implemented environment after handoff.

• Secureframe develops a repeatable CMMC implementation motion that can serve very small businesses, SMBs, mid-market companies, and more complex defense contractors without reinventing the process every time.

• Sales and Customer Success have sharper implementation packaging, better scoping inputs, and more confidence setting customer expectations.

• Product and Engineering receive clear feedback on what CMMC customers actually need to deploy, prove, and maintain readiness.

About You

• You have 2–5 years of relevant experience in technical implementation, Microsoft systems administration, security engineering, professional or managed services, or technical consulting, including customer-facing delivery.

• You are a builder. You enjoy creating structure where it does not yet exist, documenting what works, improving rough processes, and helping a new team scale beyond heroic one-off delivery.

• You are comfortable with ambiguity and early-stage operating environments. You can make progress with incomplete information, identify the next best step, and keep customers moving without waiting for every answer to be perfect.

• You have strong project-management and troubleshooting judgment and can manage multiple customer engagements, timelines, dependencies, risks, executive visibility, and cross-functional accountability.

• You have demonstrated production experience administering Microsoft Azure, Microsoft 365 GCC High, and Windows environments, with strong knowledge of Active Directory Domain Services, Entra ID, Group Policy, DNS, hybrid identity, and Microsoft domain services.

• You have direct experience deploying and troubleshooting Microsoft Sentinel and Intune, and configuring Microsoft Defender and Purview security and data-protection capabilities.

• You are proficient with PowerShell and can automate administration and configuration tasks.

• You bring strong CMMC Level 2 expertise and hands-on experience delivering readiness or remediation engagements, including implementing and validating applicable NIST SP 800-171 controls, control mapping, SSPs, POA&Ms, documentation, and assessment evidence.

• You can work with a wide range of customers, from founder-led teams with minimal IT capacity to larger organizations managing multiple departments, frameworks, facilities, and stakeholders.

• You are customer-centered and pragmatic. You can explain complex compliance and technical concepts in plain language and help customers make decisions that fit their business, risk, and timeline.

• You communicate clearly in writing and live meetings, including project plans, status updates, executive summaries, implementation risks, and internal feedback.

• You are resourceful with modern tools, including AI, and interested in building smarter workflows for implementation delivery.

• You must qualify as a U.S. person under ITAR (22 CFR § 120.62) for work involving export-controlled customer data and environments. U.S. residence or work authorization alone does not establish U.S. person status. [Draft requirement: Tyler to confirm applicability and final wording before publication.]

Nice to Have

• Experience with Azure Government, AWS GovCloud, DFARS 252.204-7012, FedRAMP, ITAR, or defense contractor environments.

• Experience in security operations center (SOC) monitoring, alert triage, incident investigation and response, and supporting DFARS 252.204-7012 cyber incident reporting workflows, including the 72-hour reporting requirement.

• Networking expertise, including Azure Firewall or third-party firewalls, VPNs, routing, network security groups, and segmentation.

• Experience supporting C3PAO assessments, partner-assisted delivery, secure enclaves, or implementing GRC and compliance automation platforms.

• Relevant certifications such as Microsoft Certified: Security Operations Analyst Associate (SC-200), Certified CMMC Professional (CCP), or Certified CMMC Assessor (CCA); other project management, security, or GRC credentials such as PMP, CSM, Security+, CISA, CISM, CRISC, or CCSK are also a plus.

• Experience building implementation playbooks, service packages, onboarding programs, or customer delivery operations from an early stage.

Why This Role Matters

CMMC is becoming a market-access requirement for thousands of companies that support the defense ecosystem. Many of these customers are not large defense primes with mature compliance teams. They are aerospace manufacturers, IT services firms, engineering companies, construction suppliers, security providers, universities, and specialized small businesses that need a practical way to prove readiness without losing focus on their core business.

Secureframe is in a strong position to help these customers because CMMC work touches areas our platform already supports: evidence, controls, policies, vendors, personnel, assets, remediation, readiness reporting, and multi-framework reuse. But winning this market requires more than software. It requires a high-trust implementation motion that helps customers scope correctly, move quickly, coordinate partners, and operationalize the program.

This role will help build that motion.

Working Style

This role is remote-friendly. Some customer or company travel may be required for strategic implementations, team planning, or partner/customer events.