Cybersecurity Compliance Engineer

Job Title: Cybersecurity Compliance EngineerDepartment: Digital Solutions Reports to: Roy Knudson, Senior Manager Digital SolutionsDirect Reports: 0Location(s): Leonardo AWPC, Philadelphia PA__________________________________________________________________________________Summary of Position: (Brief description of overall responsibilities and function)The Security Compliance Engineer is responsible for implementing, validating, and operationalizing cybersecurity controls required to achieve and maintain compliance with the NIST Cybersecurity Framework (CSF), NIST SP 800-171, and Cybersecurity Maturity Model Certification (CMMC) Level 2. Working in close partnership with the Cybersecurity team—which retains ownership of compliance policy, risk assessment, and audit governance—this role translates compliance requirements into technical solutions across Microsoft 365, Azure, endpoint management, identity services, networking, and on-premises infrastructure.This is an execution role, not an advisory one. The Cybersecurity team defines what compliance looks like; this engineer builds and sustains it. The ideal candidate is a hands-on practitioner who can read a NIST control, understand what it requires technically, implement the solution, and produce the evidence to prove it works—all without requiring direction at each step.Reporting directly to the Head of Digital Solutions, this Individual Contributor will be a high-visibility contributor whose output directly supports CMMC Level 2 certification staging and the organization’s long-term security posture hardening objectives across the US region.2. Essential Duties and Responsibilities: (Specifically describe the essential duties and responsibilities in order of estimated percentage of time that is spent on each). Duties and Responsibilities: % of Time1.Microsoft Security Platform Ownership Administer and secure the Microsoft 365, Entra ID, Intune, Defender, and Purview environments as the primary technical owner of security configuration and policy enforcementImplement and maintain core identity and access controls:Conditional Access policies, named locations, and sign-in risk rulesMulti-Factor Authentication (MFA) and Self-Service Password Reset (SSPR)Privileged Identity Management (PIM) and just-in-time access workflowsEntra ID role assignments, group lifecycle, and access reviewsBuild and maintain Microsoft Purview data governance and protection controls:Sensitivity labels and information protection policies for CUI and confidential dataData Loss Prevention (DLP) policies across M365 workloadsInsider Risk Management configuration and alert reviewRetention and compliance policies aligned to regulatory requirementsManage Intune device compliance policies, configuration profiles, and enrollment workflows across Windows endpointsOperate and tune the Microsoft Defender suite (Defender for Endpoint, Office 365, Identity, and Cloud Apps)—including alert triage, policy configuration, and integration with incident response processesDocument CUI data flows through M365 and Azure services in support of System Security Plan (SSP) development25%2.Infrastructure Security EngineeringImplement and maintain security controls across the full on-premises and hybrid infrastructure stack:Windows Server — hardening, patch compliance baselines, and audit loggingActive Directory — Group Policy security baselines, privileged account tiering, and stale object managementNetwork infrastructure — firewall policy review, segmentation validation, and NAC enforcementEndpoints — EDR/XDR policy management, compliance baselines, and removable media controlsVirtualization platforms (VMware / Hyper-V) — snapshot, access, and audit controlsCloud services — Azure RBAC, Defender for Cloud posture management, and security policyDrive vulnerability remediation activities—prioritize, assign, track, and validate closure of findings from scan results, audit reports, and assessor reviewsImplement CIS benchmark configurations and DISA STIG settings across applicable platforms and document deviations through formal change managementPartner with the Manager of Security & Infrastructure on patching discipline, MDM lifecycle, and endpoint compliance enforcementContribute to the network and infrastructure hardening roadmap, prioritized against NIST 800-171 control families SC (System & Communications Protection), AC (Access Control), AU (Audit & Accountability), and CM (Configuration Management)20%3.NIST Control Implementation & Remediation Implement technical safeguards required by NIST SP 800-171 and CMMC Level 2 across all applicable control familiesRemediate security control gaps identified through internal assessments, audits, POA&M entries, and compliance reviews—owning technical resolution from identification through evidence-confirmed closurePartner with the Cybersecurity and Risk teams to translate NIST requirements into specific, operational controls with clear, auditable evidence pathsValidate effectiveness of implemented controls through testing, configuration review, and evidence collection—producing artifacts sufficient for C3PAO assessor reviewSupport SPRS (Supplier Performance Risk System) score improvement by systematically addressing scored deficienciesContribute technical implementation details to System Security Plans (SSPs) in coordination with the Cybersecurity Compliance teamMaintain a personal remediation queue aligned to the organizational Plan of Action & Milestones (POA&M), with regular status reporting to the Head of Digital Solutions30%4.CMMC Technical Readiness Implement technical safeguards supporting CMMC Level 2 certification across all 110 practices derived from NIST SP 800-171Support SSP development by contributing architecture diagrams, data flow documentation, and system boundary definitionsProduce and maintain technical evidence artifacts for each assessed practice—configuration exports, screenshots, audit logs, and policy documentationValidate security control effectiveness through technical testing prior to formal C3PAO assessment engagementParticipate in pre-assessment walkthroughs and respond to assessor technical inquiries with demonstrated, working controlsCoordinate with the Cybersecurity Compliance team on CUI environment scoping, boundary documentation, and formal assessment schedulingSustain CMMC technical readiness posture post-certification through ongoing monitoring, quarterly self-assessment, and control validation15%5.Documentation, Reporting & CommunicationProduce and maintain technical documentation as a natural byproduct of implementation work: architecture diagrams, configuration runbooks, control implementation records, and evidence packagesDeliver concise, regular status reporting to the Head of Digital Solutions covering remediation progress, POA&M milestone tracking, and CMMC readiness milestonesContribute technical content to executive-level compliance dashboards and scorecards maintained by the Cybersecurity Compliance teamDevelop role-based security configuration guides and internal knowledge base articles for Infrastructure, Helpdesk, and end-user staffCommunicate complex technical security requirements clearly to non-technical stakeholders across HR, Legal, Procurement, and Operations10% TOTAL:100%Qualifications for Position: A. EducationBachelor’s degree in Information Security, Computer Science, Information Systems, or a related discipline requiredAn equivalent combination of formal education and demonstrated, hands-on technical experience will be considered in lieu of degreeB. Experience3–6 years of progressive experience in cybersecurity engineering, security administration, or infrastructure security rolesDemonstrated hands-on experience implementing NIST SP 800-171 controls in enterprise environments—not solely assessing or documenting themProven experience securing Microsoft 365 and Azure environments at a technical configuration level, including Entra ID, Intune, Purview, and the Defender suitePractical experience implementing controls supporting CMMC Level 2 certification or equivalent federal compliance requirements (DFARS, FedRAMP, FISMA)Track record of remediating audit findings and compliance gaps through direct technical implementation—not documentation management aloneHands-on experience with Windows Server hardening, Active Directory security, endpoint protection, and infrastructure vulnerability managementAbility to produce technical evidence artifacts—configuration exports, audit logs, test results, and screenshots—suitable for formal assessor reviewExperience interfacing across multiple business functions (IT, Legal, Procurement, Operations) to gather evidence and drive compliance outcomes C. Competencies & Attributes1.Takes full responsibility for implementation outcomes from initiation through evidence-confirmed closure. Does not require escalation to act. Treats compliance gaps as personal problems to solve, not items to hand back.2. Translates regulatory requirements into working, configured, testable controls. Comfortable operating in ambiguity and capable of self-directing the technical path from NIST requirement to implemented safeguard.3.Produces audit-ready documentation and evidence artifacts without prompting. Understands that in a compliance context, undocumented controls do not exist.4.Translates complex technical requirements for non-technical audiences. Produces executive-ready status reports and communicates proactively about delays, risks, and blockers before they become issues. Proactively identifies opportunities to harden controls beyond minimum compliance requirements. Brings a security-first mindset rather than a check-the-box approach.Handles sensitive compliance documentation, audit findings, and security configurations with strict discretion. Understands that access to this information carries professional and regulatory weight.5.Required Technical Skills: Microsoft Entra ID (Azure AD)Microsoft Intune — MDM & MAMMicrosoft Defender Suite (MDE, MDO, MDI, MDCA)Microsoft Purview — DLP, Info Protection, IRMAzure Security Center / Defender for CloudConditional Access & PIMSensitivity Labels & CUI ClassificationMicrosoft Sentinel — working knowledgeWindows Server hardening & audit controlsActive Directory — GPO, tiering, privileged accessEndpoint Detection & Response (EDR/XDR)Vulnerability Management (Tenable, Qualys, or equiv.)Network Firewalls & SegmentationCIS Benchmarks & DISA STIG implementationVirtualization — VMware / Hyper-V securityNIST SP 800-171 technical control implementation D. Licensure/CertificationCompTIA Security+Strongly PreferredBaseline cybersecurity knowledge; minimum threshold for government-adjacent compliance environmentsMicrosoft SC-401: Information Security AdministratorStrongly PreferredDirect alignment to M365 Purview, DLP, and information protection ownership responsibilitiesMicrosoft SC-100: Cybersecurity Architect ExpertStrongly PreferredArchitecture-level Microsoft security design; NIST and Zero Trust framework alignmentMicrosoft SC-200: Security Operations AnalystStrongly PreferredDefender suite operations, SIEM/SOAR, and security monitoring proficiencyCMMC Registered Practitioner (RP)Strongly PreferredFormal CMMC credentialing; signals DoD ecosystem knowledge and assessment process readinessCISSPStrong DifferentiatorBreadth of security architecture and management knowledge; signals career depth and commitmentCISMStrong DifferentiatorInformation security management focus; supports cross-functional compliance communicationCISANice to HaveAudit methodology knowledge; useful but secondary to implementation credentials for this roleISO 27001 Lead Implementer/AuditorNice to HaveComplementary for global coordination with international Digital Solutions teamsEqual Opportunity Employer/Vet/Disability