Remote opportunity at
Defense UnicornsCompliance Lead - CMMC (NIST SP 800-171)
Defense Unicorns is seeking a full-time Compliance Lead to act as the customer-facing lead for CMMC Level 1 and Level 2 engagements. In this role, you…
Career Tools
About This Role
Defense Unicorns is seeking a full-time Compliance Lead to act as the customer-facing lead for CMMC Level 1 and Level 2 engagements. In this role, you will own NIST SP 800-171 interpretation, scoping, documentation, and assessment readiness from kickoff through the C3PAO assessment and into sustainment. Defense Unicorns delivers mission value by streamlining software delivery, creating secure solutions for continuous software integration, and supporting public and private enterprises, including defense…
Job Description
Defense Unicorns is seeking a full-time Compliance Lead to act as the customer-facing lead for CMMC Level 1 and Level 2 engagements. In this role, you will own NIST SP 800-171 interpretation, scoping, documentation, and assessment readiness from kickoff through the C3PAO assessment and into sustainment. Defense Unicorns delivers mission value by streamlining software delivery, creating secure solutions for continuous software integration, and supporting public and private enterprises, including defense and civil agencies across the U.S. government.
This position requires a versatile professional who can configure controls personally in Google Workspace or Microsoft 365 GCC High, write evidentiary records, and verify results the way an assessor would. You will manage multiple concurrent client engagements, typically four to six, while operating in a remote and asynchronous environment. The role involves 10% to 25% travel for customer kickoffs, on-site readiness reviews, and C3PAO assessment weeks. Full compensation packages are determined using national benchmarking data and range from $123,250 to $166,750 USD for United States locations.
Responsibilities
- Serve as the primary customer point of contact for the life of the engagement, running kickoff sessions, status reporting, and answering NIST SP 800-171 questions directly.
- Scope the CMMC assessment boundary by tracing FCI and CUI flows, categorizing assets, and producing boundary, data-flow, and network diagrams.
- Author and maintain the System Security Plan, policies and procedures, POA&M, and evidence library at the assessment-objective level.
- Implement technical controls hands-on within customer tenants including identity, MFA, least privilege, data protection, and FIPS-validated encryption.
- Operate endpoint management across Windows, macOS, iOS, and Android utilizing Microsoft Intune and Jamf.
- Build audit logging and monitoring stacks in SIEM platforms like Microsoft Sentinel, Google SecOps, or Splunk.
- Assess finished environments against the CMMC Level 2 Assessment Guide and support clients during C3PAO assessment weeks.
- Manage client sustainment operations, including continuous monitoring, change reviews, and annual affirmations.
- Improve delivery practices by creating reusable templates, checklists, automation, and contributing to internal AI tooling.
Requirements
- Experience taking defense contractors through NIST SP 800-171 and CMMC Level 2 end-to-end, including leading at least one successful C3PAO or DIBCAC assessment.
- Proven ability to author assessor-ready documentation such as System Security Plans, POA&Ms, and data-flow diagrams.
- Hands-on experience implementing NIST SP 800-171 technical controls in Microsoft 365 GCC High or Google Workspace admin consoles.
- Endpoint management experience across Windows and macOS using Microsoft Intune or Jamf.
- Experience centralizing audit logs in a SIEM platform and operating vulnerability scanning, patching, and backups.
- Working knowledge of networking and perimeter controls to scope boundaries and verify security practices.
- Ability to run 4 to 6 concurrent client engagements and report status in an asynchronous remote environment.
Qualifications
- CMMC Certified Assessor certification strongly preferred
- CMMC Certified Professional certification required at minimum
- Lead CCA designation or Registered Practitioner Advanced status
- Implementation experience in both Google Workspace and Microsoft 365 GCC High environments
- Familiarity with Apple Business Manager, Android Enterprise, Microsoft Defender, Purview, Sentinel, or Google SecOps
- Knowledge of CIS Benchmarks or DISA STIG hardening, plus Windows Server and Active Directory in hybrid environments
- Experience with CUI enclave design and migration across GCC High, Azure Government, AWS GovCloud, or on-premises enclaves
Core Skills
Benefits
- 100 percent company-paid health, dental, and vision insurance premiums
- Health Savings Account
- Life and disability insurance
- 401k retirement plan with company stock options
- Home office budget
- Flexible Time Off plus all federal holidays, one week for Thanksgiving, and two weeks for Christmas and New Year's
- Paid parental leave
- Reimbursement for approved training, subscriptions, and conferences including travel and lodging
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
What is the salary range for the Compliance Lead role?
The salary range for this United States-based remote position is $123,250 to $166,750 USD, determined by national benchmarking data and candidate experience.
Is travel required for this position?
Yes, travel expectations are between 10% and 25% for customer kickoffs, on-site readiness reviews, and C3PAO assessment weeks.
What certifications are required or preferred?
A CMMC Certified Professional certification is required at minimum, while a CMMC Certified Assessor designation is strongly preferred.
How many concurrent engagements does the Compliance Lead typically manage?
The Compliance Lead typically runs 4 to 6 concurrent engagements in a remote, asynchronous environment.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.