MSP Compliance Engineer

MSP Compliance Engineer Bright Flow  Technologies is a growing Managed Service Provider (MSP) based in Charlotte, NC. We support small and mid-sized businesses by delivering secure, stable, and well-architected IT environments, including organizations in the defense industrial base and healthcare that depend on us to meet strict regulatory requirements.

We’re looking for an experienced MSP Compliance Engineer who has taken clients from complete non-compliance to full compliance and owned the process from start to finish. This is not an entry-level or “compliance-adjacent” role. We need someone with real, hands-on experience in CMMC, NIST SP 800-171, HIPAA, and PCI DSS who can assess a client’s environment, build the roadmap, implement controls, and keep them compliant long after the assessment is done.

You’ll report directly to executive leadership and serve as the go-to compliance expert for both our clients and our internal team.

Compensation $80,000 salary

Responsibilities

Own client compliance engagements end to end, from initial gap assessment through remediation, assessment readiness, and ongoing maintenance

Perform gap assessments against CMMC, NIST SP 800-171, HIPAA, and PCI DSS, and translate findings into clear, prioritized remediation plans

Implement technical controls directly, and direct and coordinate our engineering team on remediation work across client environments

Contribute to System Security Plans (SSPs) and Plans of Action & Milestones (POA&Ms) alongside internal and client stakeholders

Help develop and refine client security policies and procedures

Collect, organize, and maintain evidence to support compliance claims and assessments

Support clients and third-party assessors during audits and C3

PAO assessments

Lead client-facing meetings to review findings, explain requirements in plain language, and report on progress

Provide ongoing compliance monitoring for clients after they reach compliance, so they stay compliant year over year Visit client sites as needed for assessments, meetings, and remediation work Maintain accurate documentation in our PSA and our cloud-based IT documentation platform

Required Experience3–5 years of compliance experience

Proven track record of taking organizations from non-compliance to full compliance with ownership of the entire process

Hands-on experience with CMMC and NIST SP 800-171

Working experience with HIPAA and PCI DSSAbility to both implement technical controls and explain them to non-technical decision-makers

Experience managing multiple client compliance projects at the same time Bachelor’s degreeU.S. citizenship required

Required Certifications Must be active and unexpired:

CMMC Registered Practitioner (RP)
CompTIA Security+Nice to Have Microsoft GCC High experience (a huge plus)
CMMC Certified CMMC Professional (CCP)
CISSPCISAHCISPPPCI ISA or QSAExperience in medical or healthcare IT environments

What We’re Looking For Someone who has actually done the work, not just studied the frameworksA self-starter who can own a compliance program without being managed step by step Someone equally comfortable in a client boardroom and in the technical details behind the scenes

Strong attention to detail and disciplined documentation habitsA clear communicator who can make complex requirements understandableA commitment to staying current as CMMC, HIPAA, and PCI requirements evolve

This Role Is Likely Not a Fit IfYour compliance experience is limited to auditing or advising, with no hands-on implementation

You have only supported compliance for a single organization and not across multiple client environments

You haven’t owned a compliance engagement from gap assessment through to full compliance

You prefer to work fully remote or don’t want to travel to…