Senior Compliance Specialist

Reports to: Director of Compliance

Type: Full-time | Remote

The Sr. Compliance Professional will lead and support compliance assessment, readiness, and program management efforts across regulated industries, including the Defense Industrial Base, healthcare, technology, higher education, manufacturing, and financial services. This role ensures compliance with regulatory, legal, and framework requirements by assessing controls, designing and maintaining policies and processes, and guiding organizations from gap identification through remediation and certification.

The ideal candidate brings deep, hands-on knowledge of compliance frameworks such as CMMC, NIST SP 800-171, HITRUST CSF, HIPAA, SOC 2, ISO 27001, and GDPR, along with proven ability to own engagements end to end, translate control gaps into practical remediation roadmaps, and communicate risk clearly to executive and technical audiences.

• Develop, implement, and maintain compliance programs across applicable frameworks and regulations (e.g., CMMC, NIST SP 800-171, NIST CSF / SP 800-53, HITRUST, HIPAA, SOC 2, ISO 27001, PCI DSS, GDPR, CCPA).
• Perform risk assessments, gap analyses, and audits to identify non-compliance or improvement opportunities, and maintain risk registers and remediation plans.
• Coordinate with internal stakeholders, assessors, and external auditors for readiness reviews, validated assessments, certifications, recertifications, and reporting.
• Monitor regulatory and framework changes (e.g., NIST SP 800-171 Rev. 2 to Rev. 3, CMMC program updates, HITRUST CSF version changes) and advise leadership on evolving compliance obligations.
• Develop and maintain security, privacy, and compliance policies, procedures, and supporting documentation aligned to framework requirements.

• Lead CMMC Level 2 readiness engagements, including CUI and FCI scoping, asset categorization, boundary analysis, NIST SP 800-171 control testing, System Security Plan (SSP) and Plan of Action & Milestones (POA&M) development, SPRS scoring, and mock-assessment preparation.
• Lead HITRUST e1, i1, and r2 readiness and validated assessments, interim assessments, and rapid recertifications, including MyCSF administration, evidence evaluation, scoring, quality review, and submission support.
• Conduct HIPAA security and privacy risk assessments and provide cross-framework advisory across SOC 2, NIST, ISO 27001, GDPR, PCI DSS, and other controls-assurance requirements.
• Execute assessment fieldwork through stakeholder interviews, evidence requests, control testing, evidence evaluation, scoring, and workpaper development.
• Translate control gaps and findings into risk-based priorities, remediation roadmaps, and practical implementation guidance, and track remediation through to closure.
• Work with technical teams to turn compliance requirements into implementation actions and gather the evidence needed to demonstrate control effectiveness.

• Own end-to-end engagement delivery, from scoping and work planning through assessment, remediation, executive reporting, and closeout, managing budgets, timelines, staffing, risks, and status.
• Serve as a primary client lead and escalation point, managing expectations and communicating status, risks, and next steps.
• Provide quality oversight by reviewing teamwork, resolving complex control-interpretation questions, and mentoring junior staff.
• Develop and standardize assessment methodologies, templates, work papers, reports, and automation-enabled workflows.
• Support business development through proposals, statements of work, scoping, fee estimates, client pursuits, and industry speaking engagements.
• Develop and deliver compliance training programs, including role-based training, quizzes, and workshops, to ensure employee understanding of and adherence to compliance responsibilities.
• Generate metrics, reports, and executive presentations on compliance status, risks, and remediation progress for executive and board-level audiences.
• Collaborate cross-functionally with Cybersecurity, Legal, IT, HR, and Operations to embed compliance into organizational processes.

• Bachelor's degree in Information Systems, Cybersecurity, Law, Business, or a related field, or equivalent experience.
• 5+ years of experience in compliance, GRC, audit, or IT risk management roles.
• Hands-on experience leading assessments against CMMC Level 2 / NIST SP 800-171, HITRUST…