Role: CMMC GRC Consultant

Industry: Cybersecurity / Managed Services / Consulting

Location: Remote – U.S. Based

Assignment Type: 4–6 Month Contract-to-Hire

Conversion Salary: $95,000 – $115,000 / year

Travel: Limited – Approximately 1–2 Team Meetings per Year + Occasional Client Travel

Start Date: ASAP

Benefits: This role is eligible for medical, dental, vision and 401k.

About the Opportunity

Our client, a growing IT and cybersecurity services organization, is seeking a CMMC GRC Consultant to join its Governance, Risk, and Compliance team.

This is a client-facing cybersecurity compliance consulting role focused heavily on helping organizations prepare for and achieve CMMC and NIST 800-171 compliance. The Consultant will manage multiple client engagements while conducting readiness assessments, developing SSPs and POA&Ms, identifying compliance gaps, coordinating remediation efforts, and preparing clients for audits.

The ideal candidate has approximately 3–5 years of Information Security, GRC, or cybersecurity compliance experience and has already worked directly with CMMC and/or NIST 800-171.

An active CMMC CCP or CCA certification is required for consideration.

This position is well suited for an earlier-to-mid-career GRC professional who has strong CMMC knowledge, enjoys working directly with clients, and wants to continue developing within a collaborative consulting environment.

Key Responsibilities

·      Conduct CMMC readiness and gap assessments for client environments.

·      Guide clients through CMMC and NIST 800-171 compliance initiatives.

·      Develop, maintain, and deliver System Security Plans (SSPs).

·      Create and manage Plans of Action & Milestones (POA&Ms).

·      Identify compliance gaps and coordinate remediation activities.

·      Perform cybersecurity and compliance risk assessments.

·      Support clients throughout audit-readiness and assessment-preparation activities.

·      Manage multiple client compliance engagements simultaneously.

·      Establish project milestones, deliverables, timelines, and priorities.

·      Develop and maintain cybersecurity policies, procedures, governance documentation, and compliance frameworks.

·      Work directly with clients to understand their environments, compliance requirements, risks, and remediation priorities.

·      Lead client meetings and communicate project status, findings, risks, and next steps.

·      Prepare and present client-facing compliance reports and assessment findings.

·      Coordinate client onboarding and compliance-engagement activities.

·      Partner with technical teams to ensure security-control implementations align with CMMC and NIST requirements.

·      Assist clients with risk-mitigation and remediation planning.

·      Track compliance deliverables through completion.

·      Maintain awareness of evolving CMMC requirements, cybersecurity regulations, and industry best practices.

·      Contribute to internal GRC process improvements, documentation standards, and knowledge sharing.

Required Qualifications

·      Active CMMC CCP or CCA certification required.

·      3–5 years of experience within Information Security, Cybersecurity, GRC, Risk, or Compliance.

·      Hands-on experience supporting CMMC and/or NIST 800-171 compliance initiatives.

·      Experience managing and executing cybersecurity compliance projects.

·      Experience conducting readiness assessments, gap assessments, or risk assessments.

·      Hands-on experience developing or maintaining SSPs and POA&Ms.

·      Strong understanding of cybersecurity controls and compliance requirements.

·      Experience supporting audit-readiness and remediation initiatives.

·      Ability to manage multiple compliance engagements and competing deadlines simultaneously.

·      Strong understanding of Microsoft 365 environments.

·      Familiarity with Microsoft Entra ID / Azure AD.

·      Understanding of Windows-based enterprise environments.

·      Strong project-management and organizational skills.

·      Excellent written and verbal communication.

·      Strong client-facing and presentation skills.

·      Ability to translate complex cybersecurity and compliance requirements into understandable recommendations for clients.

·      Ability to collaborate effectively with both technical and non-technical stakeholders.

Preferred Qualifications

·      CMMC RPA certification.

·      CompTIA Security+ or comparable cybersecurity certification.

·      Experience within an MSP, MSSP, cybersecurity consulting, or professional-services environment.

·      Experience supporting multiple external clients simultaneously.

·      Knowledge of additional regulatory and security frameworks such as:

o  ISO 27001

o  HIPAA

o  HITRUST

o  GDPR

·      Familiarity with endpoint detection and response (EDR) technologies.

·      Vulnerability-management experience.

·      Understanding of threat-protection technologies.

·      Strong policy-writing experience.

·      Experience developing and improving compliance processes and documentation.

·      Bachelor’s degree in Cybersecurity, Information Technology, Information Security, or a related discipline, or equivalent professional experience.

What We’re Looking For

This is not a purely internal GRC role.

The successful candidate will work directly with clients and needs to be comfortable taking ownership of a compliance engagement from assessment through remediation and audit preparation.

You should be able to confidently discuss:

·      CMMC

·      NIST 800-171

·      SSPs

·      POA&Ms

·      Readiness Assessments

·      Gap Assessments

·      Risk Assessments

·      Audit Preparation

·      Policy & Procedure Development

·      Security Controls

·      Microsoft 365

·      Entra ID / Azure AD

·      Remediation Planning

Just as importantly, you should be able to sit in front of a client, explain what you’ve found, communicate what needs to change, establish realistic priorities, and keep the engagement moving toward compliance.

Ideal Background

The ideal candidate has already spent several years working within cybersecurity compliance or GRC and is looking for an opportunity to deepen their CMMC expertise.

We’re particularly interested in candidates who have personally:

·      Participated in CMMC readiness engagements

·      Worked with NIST 800-171 controls

·      Created or maintained SSPs

·      Developed and tracked POA&Ms

·      Conducted gap or risk assessments

·      Helped organizations prepare for audits

·      Written cybersecurity policies and procedures

·      Coordinated remediation with technical teams

·      Presented findings directly to clients

·      Managed multiple compliance projects at the same time

A highly experienced senior-level GRC leader is not necessary for this position. The focus is on finding someone with a strong CMMC foundation, the required certification, client-facing ability, and room to continue developing within the organization.

Work Environment

·      Fully remote within the United States

·      Collaborative GRC and cybersecurity consulting team

·      Reports into CMMC Compliance leadership

·      Multiple concurrent client engagements

·      Approximately 1–2 team meetings per year requiring travel

·      Occasional client-site travel may be required

Additional Details

·      4–6 month contract-to-hire opportunity

·      Conversion strongly preferred

·      Conversion salary approximately $100,000–$115,000 / year

·      ASAP start

·      Two-step interview process:

o  Technical interview

o  Leadership interview

·    Upon a conditional offer of employment, the position requires a background check

·      CMMC CCP or CCA certification is required

Benefits

Eligible consultants may receive:

·      Medical and prescription drug coverage

·      Dental insurance

·      Vision insurance

·      Health Savings Account (HSA)

·      Flexible Spending Accounts (FSA)

·      Short-Term and Long-Term Disability Insurance

·      Supplemental Life Insurance

·      401(k)

·      Weekly pay

If you’re a CMMC-certified GRC professional with hands-on experience supporting CMMC/NIST 800-171 readiness, SSPs, POA&Ms, risk assessments, and client compliance engagements, apply today to learn more.