CMMC Compliance Manager

The CMMC Compliance Manager guides Cuick Trac® clients through implementing and maintaining every customer‑responsible control in their environment, and prepares and supports them through third‑party (C3

PAO) assessments where required. You will be the client's trusted advisor from onboarding through certification and beyond: translating the Customer Responsibility Matrix into a practical action plan, building the documentation assessors expect, and keeping clients compliant as their business, contracts, and the regulations evolve.

The ideal candidate has hands‑on experience with NIST SP 800-171, CMMC, and the current DFARS cybersecurity clauses as they apply to Controlled Unclassified Information (CUI), Covered Defense Information (CDI), Controlled Technical Information (CTI), and export‑controlled data (ITAR/EAR).

• Walk each client through the Cuick Trac Customer Responsibility Matrix, clearly separating inherited, shared, and customer‑responsible controls.
• Create and validate client‑specific inheritance and responsibility documentation.
• Provide remediation guidance so clients fully implement their customer‑responsible NIST SP 800-171 / CMMC Level 2 requirements, including:
  • Boundary and scoping diagrams (CUI, Security Protection, Contractor Risk Managed, and Out‑of‑Scope assets)
  • Data and user flow diagrams and data management plans
  • Incident response plans and tabletop testing exercises
  • Physical security remediation advisory
  • Policies and procedures, reviewed or written from scratch

• Perform gap assessments, risk assessments, and implementation reviews against NIST SP 800-171A objectives.
• Develop and maintain the System Security Plan (SSP) and Plan of Action and Milestones (POA&M), including tracking POA&M closeout within required time frames.
• Advise clients on CMMC status entries and annual affirmations in SPRS.

• Prepare clients for CMMC Level 2 C3
  
  PAO assessments and, where applicable, DCMA DIBCAC Medium and High assessments.
• Assemble evidence packages and coach client personnel for assessor interviews and demonstrations.
• Support clients during assessments and guide remediation of any findings.

• Conduct annual compliance reviews to keep clients assessment‑ready between certifications.
• Review government contracts and solicitations for cybersecurity, CUI, and export‑control requirements, recognizing both current and legacy clause numbers.
• Build and manage compliance roadmaps based on existing and emerging cybersecurity standards.
• Administer the Governance, Risk, and Compliance (GRC) tool for assigned clients.
• Other duties as assigned based on business needs.

• 2-4 years of customer‑facing experience with NIST SP 800-171, NIST SP 800-53, CMMC, and the NIST Risk Management Framework.
• Working knowledge of the DoD cybersecurity clauses as realigned on February 1, 2026 under the Revolutionary FAR Overhaul class deviations:
  • DFARS , Safeguarding Covered Defense Information and Cyber Incident Reporting
  • DFARS , Contractor Compliance with the CMMC Level Requirements, and provision , Notice of CMMC Level Requirements
  • DFARS , NIST SP 800-171 DoD Assessment Requirements (formerly )
  • FAR 52.240-93, Basic Safeguarding of Covered Contractor Information Systems (formerly 52.204-21)
  • Awareness that legacy contracts may still cite  and
• Familiarity with the CMMC program rule (32 CFR Part 170), including scoping, POA&M, and affirmation requirements.
• Experience with firewalls, SIEM, vulnerability management, MFA, endpoint protection, DLP, and other security tools.
• Experience with risk and security assessment processes, and with tracking and remediating findings from…