IT and Security Manager

IT and Security Manager (On-Site)

We’re hiring a hands‑on IT & Security Manager to lead our company through the CMMC certification process—from gap assessment and remediation planning to control implementation, evidence collection, and assessment readiness—while owning on‑site IT operations, security governance, and compliance. You’ll administer Microsoft 365 and core IT platforms, secure our enclaves and endpoints, run SIEM/vulnerability/IR workflows, and lead audits (CMMC, NIST, FedRAMP alignment).

You’ll report to the COO, collaborate closely with engineering, operations, and leadership, and ensure controls are effective without disrupting production.

• Own CMMC end‑to‑end:
  Gap analysis → remediation roadmap → control implementation (SSP/POA&M) → objective evidence library → assessment readiness.
• Assessment readiness:
  Coordinate internal audits, stakeholder drills, assessor engagement, and track findings to closure.
• Vendor due diligence and contract clauses for CUI handling.

• Service reliability:
  Own M365 tenant administration (Entra /SSO, Intune, Exchange, SharePoint/One Drive), core IT services, and helpdesk workflows.
• Asset management:
  Provisioning, inventory, and lifecycle for laptops, peripherals, and enclave hardware; maintain CMDB accuracy.
• On/Offboarding:
  Role‑based access, least‑privilege, and auditable user transitions.
• Change management:
  Define CAB/approvals, back‑out plans, and maintenance windows with minimal disruption.

• Controls & hardening:
  Enclaves, endpoints, VMs/containers (policy baselines, MFA, encryption in transit/at rest).
• SIEM & monitoring:
  Manage detections, triage alerts, and lead incident response/post‑mortems.
• Vulnerability management:
  Scans (e.g., Nessus), risk‑based prioritization, remediation SLAs, and verification.
• Network & endpoint security:
  Firewalls, VPNs (Wire Guard/OpenVPN/IPsec), IDS/IPS, EDR, device posture.
• Automation:
  Power Shell, Bash, and Python for baselines, hardening, and evidence capture.

• Tool & hardware reviews:
  Perform security evaluations of software tools and hardware (pre‑procurement and periodic) to ensure compliance with CMMC/NIST controls and internal standards.
• Standards & artifacts:
  Assess against benchmarks, DISA STIGs, vendor hardening guides; verify SBOMs, patch cadence, logging/telemetry, data residency, encryption, and identity integrations (SSO/MFA/SCIM).
• 3rd‑party risk:
  Run security questionnaires, review pen‑test/SOC 2/FedRAMP reports, and document compensating controls and residual risk.

• Framework ownership: CMMC, NIST 800‑171/53, CSF; support FedRAMP alignment where applicable.
• Documentation:
  Maintain SSP, POA&M, policies/standards, diagrams, data flows, and objective evidence mapped to practices.
• Assessments & audits:
  Internal audits, vendor risk reviews, external assessor support.
• Training & awareness:
  Security and CUI handling enablement across teams.

• Hands‑on enclave access/process support, break/fix triage, and lab/office network hygiene.
• Vendor/tooling evaluation, renewals, and contracts that meet security/compliance needs.

• 5+ years in IT operations/service management and security within regulated/public‑sector or similar environments.
• CMMC/NIST 800‑171 leadership (gap analysis, remediation, evidence, assessor readiness).
• M365 administration (Entra /SSO, Intune, Exchange, SharePoint/One Drive) and endpoint management.
• Sec Ops: SIEM, vulnerability management, incident response; strong network security fundamentals.
• Scripting/automation:
  Power Shell, Bash, and/or Python.
• Communication & leadership:
  Clear writing, stakeholder influence, cross‑team enablement.
• Education:
  
  Bachelor’s in CS/IT/Cybersecurity or equivalent experience.
• US Citizenship required.

• CISSP, CISM, Security+, or audit certs (e.g., CISA).
• Experience with container hardening and Terraform/Kubernetes governance (policy/admission controls)—advisory/controls focus.
• Familiarity with FedRAMP, DoD IL4/IL5 expectations and evidence workflows.
• Project management experience running multi‑team initiatives.

• Exposure to spatial/immersive tech or game‑engine security.
• Cloud or full‑stack development experience (for automation/internal tools).
• Experience supporting public‑sector customers and responding to RFP/security questionnaires.