[All remote jobs](https://jobicy.com/jobs.md)[![Defense Unicorns logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/44a44784-221-1.png)](https://jobicy.com/company/defense-unicorns.md)[Defense Unicorns](https://jobicy.com/company/defense-unicorns.md) # Compliance Lead – CMMC (NIST SP 800-171) AI Summary This customer-facing compliance leadership role guides defense contractors through CMMC Level 1 and Level 2 engagements, from scope definition through C3PAO assessment readiness and sustainment. The incumbent owns NIST SP 800-171 interpretation, assessment-objective documentation, SSPs, POA&Ms, evidence libraries, and SPRS-related self-assessment work. It also requires hands-on implementation and validation of identity, endpoint, data-protection, logging, vulnerability-management, and encryption controls across Microsoft GCC High and Google Workspace environments. The role manages four to six concurrent customer engagements, supports assessment-week activities, and turns repeatable delivery work into templates and automation. Travel of 10%–25% is expected for customer kickoffs, readiness reviews, and assessment weeks.[Apply for this job](#job-application)[View company](https://jobicy.com/company/defense-unicorns.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md)SalaryUSD 123,250–166,750 / yrDepartment[Legal & Compliance](https://jobicy.com/categories/legal.md)EmploymentFull TimeExperienceSeniorPublished6 Nov 2026Apply before6 Dec 2026Listing views32Application actions2Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. Opportunity details ## About this role. ### Role Description We are seeking a CMMC Compliance Lead to join Commercial Cyber Operations. This person is the customer-facing lead for CMMC Level 1 and Level 2 engagements and owns NIST SP 800-171 interpretation, scoping, documentation, and assessment readiness from kickoff through the C3PAO assessment and into sustainment. Compliance Lead decides what the systems must satisfy, can configure the controls personally in Google Workspace or Microsoft 365 GCC High, writes the record that proves it, and verifies the result the way an assessor would. This is not a coordination role. The Compliance Lead scopes the assessment boundary, authors the System Security Plan and supporting documentation, directs and where needed performs control implementation, assesses the finished environment against the CMMC Level 2 Assessment Guide, and stands next to the customer during the assessment. They are the day-to-day point of contact for their assigned customers and answer CMMC questions with authority and in plain terms. Customer environments vary: Windows and macOS fleets, GCC High and Google Workspace tenants, Jamf and Intune, cloud and on-prem enclaves. This person has to be versatile enough to work in all of them. ### Responsibilities The listed responsibilities are not exhaustive and additional responsibilities may be assigned based on the evolving needs of the organization. We are seeking a dynamic individual who is able to adapt and take on new responsibilities as they arise. * Serve as the primary point of contact for assigned customers for the life of the engagement: run kickoff, working sessions, and status reporting; answer CMMC and NIST SP 800-171 questions directly and accurately without escalation. * Scope the CMMC assessment boundary: trace FCI and CUI flows, categorize assets per the CMMC Level 2 Scoping Guide (CUI, Security Protection, Contractor Risk Managed, Specialized, Out of Scope), and produce the boundary, data-flow, and network diagrams. * Lead each engagement through the standard delivery process from intake to assessor-ready package, holding the stage gates and evidence standards. * Author and maintain the System Security Plan, policies and procedures, POA&M, and evidence library at the assessment-objective level; score self-assessments and SPRS submissions under the DoD Assessment Methodology and 32 CFR Part 170. * Implement the technical controls hands-on in the customer tenant: identity, MFA, and conditional access in Entra ID or Google Cloud Identity; least privilege and privileged-account separation; data protection in Microsoft Purview or Google Workspace DLP; FIPS-validated encryption; configuration baselines. Decide which requirement each setting satisfies and why, and split the heavier build work with the Technical Implementation Engineer. * Stand up and operate endpoint management across Windows, macOS, iOS, and Android with Microsoft Intune and Jamf (Apple Business Manager, Android Enterprise): enrollment, compliance policies, CIS or DISA STIG baselines, BitLocker and FileVault, patching, and removable-media control. * Build the logging and monitoring stack the AU, RA, and SI practices require: centralized audit logging and alerting in a SIEM (Microsoft Sentinel, Google SecOps, Splunk, or similar), log retention and review cadence, vulnerability scanning and remediation tracking, and backup and recovery verification. * Assess the finished environment against the CMMC Level 2 Assessment Guide using examine, interview, and test methods; run the pre-assessment readiness review and close gaps before the C3PAO arrives. * Prepare customers for C3PAO assessments and support them during assessment week: evidence presentation, interview coaching, assessor questions, and post-assessment POA&M closeout. * Run sustainment for customers: continuous monitoring cadence, change reviews, annual affirmations, and reassessment readiness. * Improve the practice: turn repeatable work into templates, checklists, and automation, and contribute domain content to the team’s internal AI tooling. ### Minimum Experience and Qualifications * Experience taking defense contractors through NIST SP 800-171 / CMMC Level 2 end to end, from scoping through assessment, including at least one organization you personally led through a successful C3PAO or DIBCAC assessment as the consultant, assessor, or internal compliance lead. * Proven ability to write assessor-ready documentation: System Security Plans at the assessment-objective level, policies and procedures, POA&Ms, and data-flow and network diagrams. * Hands-on experience implementing NIST SP 800-171 technical controls yourself in Microsoft 365 GCC High (Entra ID, Intune, Purview, Defender) or Google Workspace (Admin console, Cloud Identity, context-aware access, endpoint management): the admin-console work, not only the policy; able to validate what an implementation engineer built rather than accept a screenshot. * Endpoint management experience across Windows and macOS (iOS and Android a plus) with at least one of Microsoft Intune or Jamf: enrollment, compliance and configuration policies, disk encryption, patching, and hardening baselines. * Experience centralizing audit logs and alerts in a SIEM or log platform (Microsoft Sentinel, Google SecOps, Splunk, or similar) and operating vulnerability scanning, patch management, and backup to satisfy the AU, RA, SI, and MP practices. * Working knowledge of networking and perimeter controls (firewalls, VPN and secure remote access, segmentation, DNS, wireless), enough to scope the boundary and verify the SC practices. * Customer-facing lead: runs meetings, explains requirements in plain terms to executives and IT staff, documents decisions, pushes back constructively, and delivers without close supervision. * Ability to run multiple concurrent engagements (typically 4–6), track milestones, and report status in a remote, asynchronous environment (Slack, Notion, Google Workspace). ### Preferred Experience and Qualifications * CMMC Certified Assessor (CCA) strongly preferred; CMMC Certified Professional (CCP) at minimum. Lead CCA designation or Registered Practitioner Advanced (RPA) a plus. * Hands-on implementation experience in both Google Workspace and Microsoft 365 GCC High, including GCC High migrations and Google Workspace configurations built to NIST SP 800-171. * Depth in Apple Business Manager, Android Enterprise, Microsoft Defender for Endpoint, Microsoft Purview, Microsoft Sentinel, or Google SecOps; CIS Benchmarks or DISA STIG hardening; Windows Server and Active Directory in hybrid environments. * CUI enclave design and migration: GCC High, Azure Government, AWS GovCloud, or on-prem enclaves, including FedRAMP Moderate equivalency evaluation of cloud service providers and scoping of external service providers. Travel Expectations/Requirements: 10%–25% (customer kickoffs, on-site readiness reviews, C3PAO assessment weeks) Full compensation packages are based on candidate experience. Compensation ranges are established using national benchmarking data and apply across all geographic locations within the United States. Remote – USA $123,250—$166,750 USD ### Who We Are Defense Unicorns delivers mission value by streamlining software delivery so our customers can focus on the most important challenges. We share a vision of freedom and security for the advancement of progress and innovation. Our commitment to this vision, and to our mission-driven customers, means a commitment to speed, user experience and optionality, without compromising security. Our team is composed of innovators, software engineers, and veterans with decades of experience delivering technology programs across the federal market. ### What We Do We create and deliver secure solutions for continuous software integration and delivery. Defense Unicorns consolidates the best practices for security pipelines, testing, and deployment automation in order to meet the high security requirements valued by mission owners. Our solutions are agnostic by design and we believe that growing a robust ecosystem of secure, cloud-native software solutions can help enterprise customers inside and outside the federal market buy and integrate software more easily. ### Who We Serve Defense Unicorns’ customers are mission-focused leaders across public and private enterprises. We proudly support defense and civil agencies across the U.S. government and we work closely with the creators of leading-edge software solutions to deliver value to the mission-owner by improving the security and consumability of commercial software products. ### What We Work On * Kubernetes * Cloud Environments (AWS/GCP and Azure) * Infrastructure-as-code (like Terraform/Pulumi) * Continuous Delivery and automation tooling * GitOps * Containers * CNCF projects and open source products and packages * Helm/Kustomize-Value Stream Mapping * Building and improving security delivery * Building Kubernetes and cloud native applications ### Benefits Our Unicorns Enjoy ### Health: * Medical/Dental/Vision * Premiums are 100% Company Paid * Health Savings Account * Life Insurance * Disability Insurance ### Financial: * 401k Retirement Plan * Company Stock Options * Home Office Budget ### Leave: * We offer all full-time Unicorns Flexible Time Off (FTO) plus all Federal Holidays, one week for Thanksgiving, and two weeks for Christmas and New Year’s * Paid Parental Leave ### Learning: * Reimbursement for approved trainings/subscriptions * Conferences (travel, lodging, and fees) Don’t have all the preferred experience or qualifications? Studies show that underrepresented groups like women and people of color are less likely to apply to jobs if they don’t meet every requirement listed. At Defense Unicorns, we’re committed to diversity. If you’re enthusiastic about the role but don’t match every criteria, we encourage you to apply. You could be the perfect fit for this or another role! Defense Unicorns is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, disability, sex, sexual orientation, gender identity or expression, age, national origin, veteran status, genetic information, union status and/or beliefs, or any other characteristic protected by federal, state, or local law. [CCPA DISCLOSURE](https://drive.google.com/file/d/1DzT00w2uadYw9TfdorHuEsvPccZvn_g4/view?usp=drive_link) Show more [Apply now >](https://jobicy.com/jobs/159244-compliance-lead-cmmc-nist-sp-800-171.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 5/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThis is a senior, hands-on compliance role requiring demonstrated end-to-end CMMC Level 2 delivery, technical control implementation, and assessor-ready evidence production. The lead must make authoritative scoping decisions while managing several client engagements and operating independently. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$145,000US market range (per year)$130k–$180k0$198.00k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. The employer discloses a USD 123,250–166,750 base compensation range. The yearly cadence is inferred from the full-time US role and the stated annual-scale compensation amounts; the midpoint is USD 145,000 per year. Estimated US market pay for a senior CMMC/NIST 800-171 compliance lead is approximately USD 130,000–180,000 per year. ## Core skills Skills and capabilities most closely associated with this opportunity. [CMMC Level 2](https://jobicy.com/jobs?search_keywords=CMMC%20Level%202.md)[NIST SP 800-171](https://jobicy.com/jobs?search_keywords=NIST%20SP%20800-171.md)[System Security Plans](https://jobicy.com/jobs?search_keywords=System%20Security%20Plans.md)[POA&M Management](https://jobicy.com/jobs?search_keywords=POAM%20Management.md)[C3PAO Assessment Readiness](https://jobicy.com/jobs?search_keywords=C3PAO%20Assessment%20Readiness.md)[Microsoft 365 GCC High](https://jobicy.com/jobs?search_keywords=Microsoft%20365%20GCC%20High.md)[Google Workspace](https://jobicy.com/jobs?search_keywords=Google%20Workspace.md)[Microsoft Intune](https://jobicy.com/jobs?search_keywords=Microsoft%20Intune.md)[Jamf](https://jobicy.com/jobs?search_keywords=Jamf.md)[Entra ID](https://jobicy.com/jobs?search_keywords=Entra%20ID.md)[Microsoft Purview](https://jobicy.com/jobs?search_keywords=Microsoft%20Purview.md)[SIEM Monitoring](https://jobicy.com/jobs?search_keywords=SIEM%20Monitoring.md)[Vulnerability Management](https://jobicy.com/jobs?search_keywords=Vulnerability%20Management.md)[CIS Benchmarks](https://jobicy.com/jobs?search_keywords=CIS%20Benchmarks.md)[DISA STIGs](https://jobicy.com/jobs?search_keywords=DISA%20STIGs.md) Sample interview questionsDescribe an end-to-end CMMC Level 2 engagement you led through an external assessment.I would explain how I defined the CUI boundary, mapped assets and data flows, authored the SSP and evidence plan, coordinated control implementation, performed readiness testing, and supported the customer during assessor interviews. I would also quantify the gaps closed and describe how post-assessment POA&M items were governed. How do you determine whether a system belongs inside a CMMC assessment boundary? I trace FCI and CUI creation, storage, processing, and transmission, then identify connected security-protection assets and supporting services. I categorize assets under the CMMC scoping guidance, document assumptions and data flows, and validate the resulting boundary with both technical and business stakeholders. How would you validate that an Intune or Jamf configuration satisfies a NIST SP 800-171 requirement? I map the configuration to the specific assessment objective, inspect the live tenant settings and endpoint state, and collect repeatable evidence rather than relying only on screenshots. I then test the expected behavior, record any limitations, and ensure the SSP accurately reflects the implemented control. What evidence would you prepare for audit logging and monitoring practices? I would provide logging architecture and data-flow documentation, SIEM configurations, retention settings, alert rules, review procedures, sample review records, incident tickets, and access controls for the logging platform. Evidence should demonstrate that logs are collected, protected, reviewed, and acted on consistently. How do you manage several concurrent compliance engagements without lowering evidence quality? I use standardized stage gates, evidence checklists, templates, clear ownership, and milestone reporting for every client. I prioritize work by assessment dates and control risk, maintain an auditable decision log, and communicate blockers early through concise status updates. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Dandy logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/2321b7db-221-1.jpeg) Dandy Nov 6 New ### [Senior Counsel, Commercial](https://jobicy.com/jobs/159252-senior-counsel-commercial-2.md) Dandy is transforming the massive and antiquated dental industry—an industry worth over $400B. Backed by some of the world’s leading venture capital firms, we’re on an ambitious mission to simplify… * ![Abby Care logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/3d3ea8fe-221.jpeg) Abby Care Nov 6 New ### [Associate General Counsel, Privacy, Product & AI](https://jobicy.com/jobs/154689-associate-general-counsel-privacy-product-ai.md) About Abby Care: Powering the future of care at home for all of America. Abby Care is building the leading AI-native platform for family-led care. America is facing a growing… * ![Binance logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/bc822f38-221.jpg) Binance Nov 5 New ### [Sanctions Operations Analyst (1 year contract)](https://jobicy.com/jobs/159169-sanctions-operations-analyst-1-year-contract.md) Binance is a leading global blockchain ecosystem behind the world’s largest cryptocurrency exchange by trading volume and registered users. We are trusted by 300+ million people in 100+ countries for… * ![Playson logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/6f266d9c-221-1.png) Playson Nov 5 New ### [Legal Counsel](https://jobicy.com/jobs/159162-legal-counsel-3.md) We’re looking for a proactive, detail-oriented Middle/Senior Legal Counsel to join our Legal Team. Key Responsibilities • Build corporate legal structure for the projects; • Legal support for the projects;… * ![ANGI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/09/50cccf084c34089de2274f72e18841d0.jpg) ANGI Nov 5 New ### [Litigation and Risk Paralegal](https://jobicy.com/jobs/159145-litigation-and-risk-paralegal.md) For over 30 years, Angi has powered the future of the home services industry, creating an environment where homeowners and pros benefit from more jobs done well. For homeowners, our… * ![AlphaSense logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/01960e94-221.jpg) AlphaSense Nov 5 New ### [Contracts Manager](https://jobicy.com/jobs/159141-contracts-manager.md) About AlphaSense: AlphaSense is the AI platform redefining market intelligence and workflow orchestration, trusted by thousands of leading organizations to drive faster, more confident decisions in business and finance. The… * ![AlphaSense logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/01960e94-221.jpg) AlphaSense Nov 5 New ### [Compliance Analyst (Night Shift- Pacific Time)](https://jobicy.com/jobs/159138-compliance-analyst-night-shift-pacific-time.md) About AlphaSense: AlphaSense is the AI platform redefining market intelligence and workflow orchestration, trusted by thousands of leading organizations to drive faster, more confident decisions in business and finance. The… * ![AlphaSense logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/01960e94-221.jpg) AlphaSense Nov 5 New ### [Associate Counsel, Employment](https://jobicy.com/jobs/159132-associate-counsel-employment.md) About AlphaSense: AlphaSense is the AI platform redefining market intelligence and workflow orchestration, trusted by thousands of leading organizations to drive faster, more confident decisions in business and finance. The… * ![Paddle logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/28ca3645-221.png) Paddle Nov 5 New ### [Senior Legal Counsel](https://jobicy.com/jobs/159093-senior-legal-counsel-4.md) What do we do? Paddle offers digital product companies a completely different approach to their payment infrastructure. Instead of assembling and maintaining a complex stack of payments-related apps and services,… * ![Socure logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/02/4dd877ff6ea919681d6e790a57ab639c.jpeg) Socure Nov 5 New ### [Legal Counsel, Identity & Trust Products](https://jobicy.com/jobs/159085-legal-counsel-identity-trust-products.md) Why Socure? Socure is building the identity trust infrastructure for the digital economy — verifying 100% of good identities in real time and stopping fraud before it starts. The mission… [Browse all jobs](https://jobicy.com/jobs.md)