Compliance Consultant, CMMC
C3 Integrated Solutions works with U.S. federal and defense contractors, many of whom are small and mid-sized businesses in aerospace and defense, manufacturing, technology, or R&D, to implement security controls and help develop mature cybersecurity and compliance practices.
The Compliance Consultant plays a lead role in the development and management of a Governance, Risk, and Compliance (GRC) program within client organizations. This role works collaboratively with client stakeholders including business leaders and internal IT, as well as C3’s professional services and managed services teams and third-party service providers.
What You'll Do
To assist the client in achieving and maintaining compliance, the Compliance Consultant will:
Document the flow of sensitive and controlled data types through existing business processes
Determine a system scope (technology, people, business processes) for compliance
Collaborate with customers, technical, and functional teams to define, document, and deliver security documentation and artifacts
Assess the current implementation of applicable technical and non-technical requirements (e.g., CMMC, DFARS, FAR, export controls)
Develop and manage System Security Plan(s), policies, and procedures
Manage customer expectations, internal and external resources, and relevant third parties to ensure engagements are successful
Develop and maintain subject matter expertise in the laws, regulations, and government-wide policies that govern cybersecurity data protection for the U.S. Defense Industrial Base, including:
DFARS (NIST SP 800-171, FedRAMP equivalency)
CMMC (Levels 1 & 2, boundary scoping)
CUI Program (NARA CUI Registry, CUI/CDI/CTI, FCI)
Export controls (ITAR/EAR)
Provide ongoing advisory to clients on issues related to security and compliance
Assist team members with client needs as needed
What You'll Bring
You’re a strong communicator interested in a fast-paced career in security consulting and professional services. You’re confident, positive, and empathetic with a passion for details. Your background includes hands-on experience managing compliance programs and you have a proven history of delivering excellent work. A background in IT/IS, compliance and risk management, or management consulting is desirable, as is in-depth experience with one or more security frameworks (e.g., CMMC, NIST, CIS, MITRE ATT&CK).
Hands-on experience implementing NIST SP 800-171 or SP 800-53 is required.
3 or more years of experience implementing cybersecurity requirements for Department of Defense contractors (DFARS 252.204-7012, NIST SP 800-171) or federal information systems (RMF, NIST SP 800-53)
Very strong written and verbal communication skills, with the ability to convey technical information as a subject matter expert (SME) for various compliance frameworks
High emotional intelligence and interpersonal skills, with an enthusiasm for collaboration and coordination with various client company stakeholders from executive management to entry-level staff
Strong organizational and time management skills with ability to correctly prioritize workload to maintain schedules, deadlines, and standards on assigned projects
Ability to remain calm under pressure and be adaptable
Ability to cross-train into other specialties
Understanding of the cybersecurity product/vendor landscape and current security best practices
Subject matter expertise in CMMC assessment and certification requirements (including assessment objectives up to Level 2) and DFARS 252.204-7012 requirements (including FedRAMP Moderate equivalency requirements for cloud service providers and paragraph (c) – (g) requirements)
Awareness of U.S. export control requirements under ITAR and EAR
Occasional (Apply To This Job
The Compliance Consultant plays a lead role in the development and management of a Governance, Risk, and Compliance (GRC) program within client organizations. This role works collaboratively with client stakeholders including business leaders and internal IT, as well as C3’s professional services and managed services teams and third-party service providers.
What You'll Do
To assist the client in achieving and maintaining compliance, the Compliance Consultant will:
Document the flow of sensitive and controlled data types through existing business processes
Determine a system scope (technology, people, business processes) for compliance
Collaborate with customers, technical, and functional teams to define, document, and deliver security documentation and artifacts
Assess the current implementation of applicable technical and non-technical requirements (e.g., CMMC, DFARS, FAR, export controls)
Develop and manage System Security Plan(s), policies, and procedures
Manage customer expectations, internal and external resources, and relevant third parties to ensure engagements are successful
Develop and maintain subject matter expertise in the laws, regulations, and government-wide policies that govern cybersecurity data protection for the U.S. Defense Industrial Base, including:
DFARS (NIST SP 800-171, FedRAMP equivalency)
CMMC (Levels 1 & 2, boundary scoping)
CUI Program (NARA CUI Registry, CUI/CDI/CTI, FCI)
Export controls (ITAR/EAR)
Provide ongoing advisory to clients on issues related to security and compliance
Assist team members with client needs as needed
What You'll Bring
You’re a strong communicator interested in a fast-paced career in security consulting and professional services. You’re confident, positive, and empathetic with a passion for details. Your background includes hands-on experience managing compliance programs and you have a proven history of delivering excellent work. A background in IT/IS, compliance and risk management, or management consulting is desirable, as is in-depth experience with one or more security frameworks (e.g., CMMC, NIST, CIS, MITRE ATT&CK).
Hands-on experience implementing NIST SP 800-171 or SP 800-53 is required.
3 or more years of experience implementing cybersecurity requirements for Department of Defense contractors (DFARS 252.204-7012, NIST SP 800-171) or federal information systems (RMF, NIST SP 800-53)
Very strong written and verbal communication skills, with the ability to convey technical information as a subject matter expert (SME) for various compliance frameworks
High emotional intelligence and interpersonal skills, with an enthusiasm for collaboration and coordination with various client company stakeholders from executive management to entry-level staff
Strong organizational and time management skills with ability to correctly prioritize workload to maintain schedules, deadlines, and standards on assigned projects
Ability to remain calm under pressure and be adaptable
Ability to cross-train into other specialties
Understanding of the cybersecurity product/vendor landscape and current security best practices
Subject matter expertise in CMMC assessment and certification requirements (including assessment objectives up to Level 2) and DFARS 252.204-7012 requirements (including FedRAMP Moderate equivalency requirements for cloud service providers and paragraph (c) – (g) requirements)
Awareness of U.S. export control requirements under ITAR and EAR
Occasional (Apply To This Job