CMMC Compliance Manager (REMOTE)

• Walk each client through the Cuick Trac Customer Responsibility Matrix, clearly separating inherited, shared, and customer-responsible controls.
• Create and validate client-specific inheritance and responsibility documentation.
• Provide remediation guidance so clients fully implement their customer-responsible NIST SP 800-171 / CMMC Level 2 requirements, including:
  • Boundary and scoping diagrams (CUI, Security Protection, Contractor Risk Managed, and Out-of-Scope assets)
  • Data and user flow diagrams and data management plans
  • Incident response plans and tabletop testing exercises
  • Physical security remediation advisory
  • Policies and procedures, reviewed or written from scratch

• Perform gap assessments, risk assessments, and implementation reviews against NIST SP 800-171A objectives.
• Develop and maintain the System Security Plan (SSP) and Plan of Action and Milestones (POA&M), including tracking POA&M closeout within required timeframes.
• Advise clients on CMMC status entries and annual affirmations in SPRS.

• Prepare clients for CMMC Level 2 C3PAO assessments and, where applicable, DCMA DIBCAC Medium and High assessments.
• Assemble evidence packages and coach client personnel for assessor interviews and demonstrations.
• Support clients during assessments and guide remediation of any findings.

• Conduct annual compliance reviews to keep clients assessment-ready between certifications.
• Review government contracts and solicitations for cybersecurity, CUI, and export-control requirements, recognizing both current and legacy clause numbers.
• Build and manage compliance roadmaps based on existing and emerging cybersecurity standards.
• Administer the Governance, Risk, and Compliance (GRC) tool for assigned clients.
• Other duties as assigned based on business needs.

• 2–4 years of customer-facing experience with NIST SP 800-171, NIST SP 800-53, CMMC, and the NIST Risk Management Framework.
• Working knowledge of the DoD cybersecurity clauses as realigned on February 1, 2026 under the Revolutionary FAR Overhaul class deviations:
  • DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting
  • DFARS 252.204-7021, Contractor Compliance with the CMMC Level Requirements, and provision 252.204-7025, Notice of CMMC Level Requirements
  • DFARS 252.240-7997, NIST SP 800-171 DoD Assessment Requirements (formerly 252.204-7020)
  • FAR 52.240-93, Basic Safeguarding of Covered Contractor Information Systems (formerly 52.204-21)
  • Awareness that legacy contracts may still cite 252.204-7019 and 252.204-7020
• Familiarity with the CMMC program rule (32 CFR Part 170), including scoping, POA&M, and affirmation requirements.
• Experience with firewalls, SIEM, vulnerability management, MFA, endpoint protection, DLP, and other security tools.
• Experience with risk and security assessment processes, and with tracking and remediating findings from audits or assessments.
• POA&M management.
• Knowledge of DoD cybersecurity policy, governance best practices, and emerging trends.
• Working knowledge of operating systems, security applications, and basic network protocols, tools, and infrastructure.
• Strong written and verbal communication; able to explain technical requirements to non-technical business owners.
• Strong project management skills, with the ability to run multiple client engagements at once. This includes planning timelines and milestones, prioritizing competing deadlines, tracking deliverables, and keeping each client informed of status and next steps.
• Consultative client management: delivers difficult findings with tact, builds trust, and handles pushback while keeping the client relationship strong.
• Teaching and coaching: helps client personnel understand and take ownership of their customer-responsible controls, and prepares them to answer assessor questions on their own.
• Exceptional attention to detail: keeps SSPs, diagrams, evidence, and other documentation accurate and consistent with each other.
• Microsoft Office / Microsoft 365.
• Occasional travel may be required.

• Incident response planning and tabletop exercises: writing and updating incident response plans, and designing and facilitating tabletop exercises that test clients' detection, escalation, and reporting procedures, including DoD's 72-hour cyber incident reporting requirement.
• Familiarity with emerging and upcoming compliance requirements, and the ability to help clients prepare for them:
  • NIST SP 800-171 Revision 3
  • The FAR Controlled Unclassified Information (CUI) rule
  • The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)

2-4 years customer-facing experience with NIST SP 800-171, NIST SP 800-53, CMMC, and NIST RMF; knowledge of DoD cybersecurity clauses; experience with security tools; strong communication and project management; U.S. person requirement.

Key Responsibilities

• implementing compliance controls
• preparing assessment documentation
• managing client engagements

Skills & Tools

Microsoft Office, Microsoft 365, SIEM, firewalls, vulnerability management, MFA, endpoint protection, DLP

Job Details

• Category: Information Technology
• Seniority: Mid Level
• Commitment: Full Time
• Workplace: Remote — Dallas, Texas, United States
• Languages: English

About Beryllium InfoSec

An information security and cyber security company providing risk assessments and compliance services. — Industry: Information Technology