Compliance Manager and Technical Solutions Lead

Job Description

About Iviry

\n

Iviry, LLC is a well-established, rapidly growing, veteran-owned IT services company providing Managed Services and Managed Security Services (MSP/MSSP) including a Security Operations Center (SOC). Our cyber-compliance focus is on National Institute of Standards and Technology and Cybersecurity Maturity Model Certification (NIST/CMMC) Gap Analysis, Remediation, Compliance, Cyber Hygiene and Sustainment primarily for Defense Industrial Base (DIB) contractors but also including commercial companies as well as local, municipal and state agencies. Iviry supports multiple customer environments in an established compliance program covering the entire United States and a healthy, growing pipeline extending into Indo-PACOM (Philippines, Australia, Japan, Guam, Hawaii).

\n

\n

Position Summary

\n

Iviry is seeking a self-directed, technically capable CMMC Compliance Manager / Technical Solutions Lead to own customer cybersecurity compliance engagements from assessment through remediation, readiness, and sustainment. This customer-facing role combines GRC leadership with hands-on systems administration, technical solutioning, and implementation.

\n

\n

The successful candidate will quickly assume ownership of active engagements, manage SSPs and POA&Ms, coordinate customers and technical resources, execute common remediation, and validate controls and evidence. Prior customer-facing CMMC or NIST SP 800-171 service-delivery experience is essential.

\n

\n

The role is approximately 50% GRC/CMMC engagement ownership and 50% technical remediation and project delivery. The individual must be able to lead repeatable work involving Microsoft 365 GCC/GCC High, secure enclaves, identity, endpoint security, logging, monitoring, and firewall requirements. Complex architecture, advanced networking, major migrations, and nonstandard engineering will be escalated to senior engineering resources. Limited travel may be required.

\n

\n

Location: Remote; Limited travel may be required.

\n

\n

Salary: A salary range of $110,000 - $135,000 is available for this position. Actual compensation will be determined based on factors including experience, education, certifications, technical qualifications, security clearance, and internal equity. In addition to base salary, this position is eligible for a comprehensive benefits package.

\n

\n
• Benefits Include:
\n
• Medical, Dental, and Vision Insurance
\n
• 401(k) with Company Match
\n
• Paid Time Off and Paid Holidays
\n
• Life and Disability Insurance
\n

\n

\n

Primary Responsibilities:

\n

Compliance, GRC & Engagement Ownership

\n

\n
• Own assigned NIST SP 800-171 and CMMC customer engagements from initial assessment through remediation, assessment readiness, and sustainment.
\n
• Perform compliance assessments and gap analyses and determine the current state of customer environments against applicable requirements and assessment objectives.
\n
• Develop, review, maintain, and actively manage System Security Plans (SSPs), POA&Ms, security policies, procedures, control narratives, and supporting compliance documentation.
\n
• Develop and drive remediation plans that define findings, required actions, dependencies, owners, priorities, schedules, and completion criteria.
\n
• Coordinate evidence collection, control validation, readiness reviews, assessor/C3PAO interaction, and customer response activities.
\n
• Maintain accurate engagement plans, schedules, risks, dependencies, action items, and customer communications.
\n
• Serve as a customer-facing delivery lead, explaining requirements, implementation options, risk, remediation priorities, and project status.
\n
• Support sustainment activities, recurring reviews, continuous monitoring, and maintenance of compliance artifacts after initial remediation.
\n

\n

\n

Technical Project Ownership

\n

\n
• Assume project ownership of active engagements following a focused transition and establish or rebuild project plans when needed.
\n
• Translate findings and POA&M items into technical work packages with defined tasks, dependencies, schedules, and resource needs.
\n
• Coordinate customer, compliance, and engineering participants and maintain accountability for assigned actions.
\n
• Track planned versus completed work, surface blockers early, and maintain accountability for assigned actions.
\n
• Maintain clear project status and ensure completed technical work is documented, validated, and reflected in the applicable compliance artifacts.
\n
• Support accurate timekeeping, task completion, and billable-work documentation associated with customer engagements.
\n

\n

\n

Technical Remediation & Systems Administration

\n

\n
• Independently execute and validate routine and intermediate technical remediation associated with NIST/CMMC findings and established standards.
\n
• Perform hands-on administration and security configuration within Microsoft 365, Entra ID, Intune, Defender, and related Microsoft security and compliance platforms.
\n
• Implement identity and access controls, including account configuration, privileged access, authentication, and Conditional Access.
\n
• Implement endpoint security baselines, device-management policies, endpoint protection, and configuration hardening.
\n
• Configure logging, monitoring, alerting, auditing, and evidence-generation capabilities required by compliance objectives.
\n
• Validate implemented controls technically and confirm that remediation satisfies the associated compliance requirement and evidence objective.
\n
• Document configurations, implementation decisions, validation results, and assessment-ready evidence.
\n
• Improve Iviry's compliance delivery methodology through repeatable workflows, procedures, checklists, templates, evidence standards, and quality controls.
\n
• Escalate advanced architecture, cloud engineering, infrastructure, networking, major migrations, and other work beyond the role's competency while coordinating remediation through completion.
\n

\n

\n

Technical Compliance Projects & Solutioning

\n

\n
• Lead technical compliance projects involving Microsoft 365 GCC/GCC High, secure enclaves, identity, endpoint management, security baselines, logging, and monitoring.
\n
• Conduct customer discovery to define enclave boundaries, users, devices, applications, data flows, licensing, dependencies, implementation activities, and acceptance criteria.
\n
• Determine whether firewalls, network segmentation, secure remote access, logging, monitoring, or related capabilities are required.
\n
• Develop firewall and network-security requirements and coordinate selection, procurement, onsite activities, configuration, testing, documentation, and validation.
\n
• Develop project scopes, implementation plans, technical work packages, assumptions, dependencies, resource requirements, validation procedures, and customer handoff documentation for assigned technical projects.
\n
• Independently deliver repeatable technical solutions within established Iviry standards and escalate complex architecture, advanced networking, major migrations, and nonstandard requirements to senior engineering resources.
\n

\n

\n

Required Qualifications

\n

\n
• 3-5 years of relevant experience delivering cybersecurity compliance, systems administration, security engineering, or technical remediation services.
\n
• Prior customer-facing experience in an MSP, MSSP, RPO, C3PAO, cybersecurity consultancy, or comparable professional-services organization supporting Defense Industrial Base (DIB) customers through multiple NIST SP 800-171 and/or CMMC engagements involving assessment, remediation, readiness, or sustainment.
\n
• Hands-on experience managing SSPs, POA&Ms, findings, remediation actions, control narratives, evidence packages, assessment readiness activities, and C3PAO support through completion.
\n
• Demonstrated ability to translate compliance requirements and assessment findings into practical technical actions and implement and validate the resulting security controls.
\n
• Hands-on competency administering and securing Microsoft 365, including Entra ID, Intune, Defender, and PowerShell used to execute, review, troubleshoot, and safely modify scripts for administration, evidence collection, and repeatable remediation.
\n
• Working knowledge of Microsoft 365 GCC/GCC High, secure enclaves, firewalls, network segmentation, VPN/remote access, secure data flows, logging, monitoring, and administrative access.
\n
• Experience independently owning and managing multiple technical projects or customer engagements, including scope, schedules, dependencies, competing priorities, communication, documentation, and validation.
\n
• Strong customer-facing consulting, facilitation, communication, and documentation skills with technical and non-technical stakeholders.
\n
• Demonstrated ability to recognize technical complexity, work within defined competencies and standards, and engage senior engineering resources when advanced architecture or implementation support is required.
\n

\n

\n

Preferred Qualifications

\n

\n
• Direct experience supporting GCC, GCC High, Azure Government, secure-enclave, or comparable regulated cloud projects.
\n
• Relevant certifications such as:
\n
• CompTIA Security+, CySA+, CASP+/SecurityX
\n
• CISM, CRISC, CISSP
\n
• ISO 27001 Lead Implementer/Auditor
\n
• Cyber AB RP/CCA/CCP (if applicable)
\n
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Security, Information Systems, Engineering, Management Information Systems, or a related discipline is preferred. Significant directly relevant CMMC, cybersecurity, systems-administration, engineering, or professional-services experience may be substituted for formal education.
\n

\n

\n

Key Skills & Competencies

\n

\n
• Must be a U.S. Citizen.
\n
• Timeliness and accuracy of work is essential.
\n
• Clear communicator with both technical and non-technical audiences.
\n
• Must be able to independently own assigned work while collaborating effectively with compliance, engineering, service-delivery, account-management, marketing, sales customer, and assessor stakeholders.
\n
• Self-directed and capable of operating in ambiguous or evolving environments.
\n
• Must be able to multi-task and dynamically adjust priority of effort.
\n

\n

\n

Iviry, LLC is an Equal Opportunity Employer with a strong commitment to supporting and retaining a diverse and talented workforce.Iviry, LLC offers competitive compensation and benefits as well as great long-term career opportunities.

\n

1901 South Bell Street, Suite 325, Arlington, VA 22202

\n

View phone number on ziprecruiter.com