MSP Compliance Engineer

Bright Flow Technologies is a growing Managed Service Provider (MSP) based in Charlotte, NC. We support small and mid-sized businesses by delivering secure, stable, and well-architected IT environments, including organizations in the defense industrial base and healthcare that depend on us to meet strict regulatory requirements.

• $80,000 salary

• Own client compliance engagements end to end, from initial gap assessment through remediation, assessment readiness, and ongoing maintenance
• Perform gap assessments against CMMC, NIST SP 800-171, HIPAA, and PCI DSS, and translate findings into clear, prioritized remediation plans
• Implement technical controls directly, and direct and coordinate our engineering team on remediation work across client environments
• Contribute to System Security Plans (SSPs) and Plans of Action & Milestones (POA&Ms) alongside internal and client stakeholders
• Help develop and refine client security policies and procedures
• Collect, organize, and maintain evidence to support compliance claims and assessments
• Support clients and third-party assessors during audits and C3
  
  PAO assessments
• Lead client-facing meetings to review findings, explain requirements in plain language, and report on progress
• Provide ongoing compliance monitoring for clients after they reach compliance, so they stay compliant year over year
• Visit client sites as needed for assessments, meetings, and remediation work
• Maintain accurate documentation in our PSA and our cloud-based IT documentation platform

• 3–5 years of compliance experience
• Proven track record of taking organizations from non-compliance to full compliance with ownership of the entire process
• Hands-on experience with CMMC and NIST SP 800-171
• Working experience with HIPAA and PCI DSS
• Ability to both implement technical controls and explain them to non-technical decision-makers
• Experience managing multiple client compliance projects at the same time
• Bachelor’s degree
• U.S. citizenship required

Must be active and unexpired

• CMMC Registered Practitioner (RP)
• CompTIA Security+

• Microsoft GCC High experience (a huge plus)
• CMMC Certified CMMC Professional (CCP)
• CISSP
• CISA
• HCISPP
• PCI ISA or QSA
• Experience in medical or healthcare IT environments

• Someone who has actually done the work, not just studied the frameworks
• A self-starter who can own a compliance program without being managed step by step
• Someone equally comfortable in a client boardroom and in the technical details behind the scenes
• Strong attention to detail and disciplined documentation habits
• A clear communicator who can make complex requirements understandable
• A commitment to staying current as CMMC, HIPAA, and PCI requirements evolve

• Your compliance experience is limited to auditing or advising, with no hands-on implementation
• You have only supported compliance for a single organization and not across multiple client environments
• You haven’t owned a compliance engagement from gap assessment through to full compliance
• You prefer to work fully remote or don’t want to travel to client sites
• You dislike documentation or evidence management

• Health, dental, and vision insurance plus PTO (after 60 days)
• Company device and access to company vehicles
• Fully stocked kitchen with your favorite snacks
• Collaborative, professional team culture with real ownership and accountability
• Ongoing training and professional development, including support for certifications

At Bright Flow Technologies, our Compliance Engineer is a key part of how we protect our clients and their businesses. You’ll have direct access to leadership, real ownership of the compliance practice, and a meaningful impact on organizations that depend on getting this right.

If you’ve guided clients through the full compliance journey and want a role where your expertise is trusted, we’d love to talk.