Senior Cybersecurity Compliance Consultant (US Remote)

1. Client Advisory & vCISO Delivery: 

• Serve as the assigned security officer (vCISO) for a portfolio of client engagements: lead recurring meeting cadences, act as the primary point of contact for clients' cybersecurity concerns and provide regular updates and reports on the status of security initiatives, including performance metrics, findings, and recommendations for improvement. 
• Build strong client relationships, understand each client's unique regulatory and business requirements, and address their needs with tailored strategies and security roadmaps. 
• Identify above-contract demand and security program growth opportunities within assigned accounts, surfacing right-sizing and expansion recommendations to practice leadership ahead of contract renewal. 
• Track and maintain contract health ensuring that issues with delivery are communicated early. 

2. Compliance Program Delivery: 

• Lead CMMC Level 1 and Level 2 readiness engagements: NIST SP 800-171 control assessments, System Security Plan (SSP) development, POA&M creation and management, SPRS score submission support, evidence collection, and client preparation for third-party assessment. 
• Advise clients on CUI scoping, DFARS 252.204-7012 and FAR 52.204-21 obligations, and enclave architectures, including Microsoft GCC High environments. 
• Deliver compliance engagements across additional frameworks as assigned, including HIPAA / HITECH, SOC 2 (Types I and II), PCI DSS v4.0, FTC Safeguards Rule, GLBA, ISO/IEC 27001 and 27002, NIST Cybersecurity Framework 2.0, NIST SP 800-53, CIS Critical Security Controls v8, and AI governance (NIST AI RMF, ISO/IEC 42001). 
• Advise on sector- and state-specific regimes as engagements require, including NY DFS 23 NYCRR Part 500, SEC cybersecurity disclosure rules, CJIS Security Policy, StateRAMP / FedRAMP readiness, and U.S. state privacy laws (CCPA/CPRA and successors) alongside GDPR and ISO/IEC 27701 where clients have international exposure. 
• Map overlapping control sets across frameworks to build unified control matrices, eliminating duplicate evidence collection across a client's concurrent compliance obligations. 

3. Security Assessment & Engineering Support: 

• Conduct comprehensive risk assessments to identify potential threats and vulnerabilities, develop and implement mitigation strategies to enhance clients' security postures, and monitor compliance with regulatory requirements and industry standards, recommending remediation actions to address gaps or deficiencies.
• Oversee data collection efforts to verify compliance and gather critical security information within client infrastructures, ensuring accuracy and reliability.
• Review and interpret security tooling outputs across the Microsoft security stack (Defender XDR, Sentinel, Entra ID Protection, Intune, Purview, Conditional Access) and coordinate remediation with client IT teams and internal engineers.

4. Other Responsibilities: 

• Perform general Security Officer duties, such as running security huddles, supporting cyber insurance questionnaires and attestations, and ensuring security tool functionality for assigned clients. 
• Assist with incident response (IR) activities, including possibly participating in the on-call incident escalation rotation, supporting SOC coordinators, communicating with key stakeholders during incidents, contributing to playbooks, and conducting postmortems with clients.
• Maintain accurate, timely time entries in the PSA (ConnectWise Manage); delivered hours are the practice's operational and financial source of truth.
• Contribute to scalable templates, engagement processes, and the practice knowledge base, fostering a culture of continuous improvement and knowledge sharing.
• Serve as an escalation resource on advanced framework interpretation and control-determination questions, and support quality review of compliance deliverables prior to client or assessor submission.
• Stay informed about emerging threats, vulnerabilities, and regulatory changes — including the DoD's phased CMMC rollout — assessing their potential impact on clients and adjusting strategies accordingly. 

Credentials & Eligibility: 

• CISSP (active and in good standing) — required at time of hire. This is a hard requirement: commitments to obtain, lapsed or Associate-level credentials, and equivalent-experience substitutions will not be considered.
• CMMC ecosystem credentials required: CCP (Certified CMMC Professional) active at time of hire, with CCA (Certified CMMC Assessor) required within the first 12 months. Registered Practitioner (RP) status alone does not satisfy this requirement.
• Additional certifications a plus: CISM, CRISC, CISA, GIAC (GSLC, GCCC), CompTIA Security+, Security X, Microsoft SC-series.
• Minimum eight (8) years of progressive information security experience, including at least three (3) years delivering compliance or vCISO engagements across a multi-client portfolio in a consulting, MSP, or MSSP environment or something similar.
• Demonstrated ownership of at least two (2) completed CMMC Level 2 readiness engagements, or equivalent NIST SP 800-171 assessment work, including SSP authorship and POA&M management through to third-party assessment.
• Documented working depth in a minimum of three (3) distinct regulatory frameworks — surface familiarity across many frameworks is not a substitute for demonstrated depth.
• Experience defending deliverables and control determinations directly to auditors, third-party assessors, or regulators.
• U.S. person status (U.S. citizen or lawful permanent resident) required due to access to Controlled Unclassified Information (CUI) under DFARS flow-down obligations.
• U.S.-based remote with reliable availability across U.S. business time zones; occasional travel to client sites for assessment support. 

Technical Skills: 

Cybersecurity & Compliance Knowledge: 

• Working command of cybersecurity principles and practices, including compliance standards and regulations such as CMMC / NIST SP 800-171 and 800-171A, NIST SP 800-53, NIST CSF 2.0, HIPAA / HITECH, SOC 2, PCI DSS v4.0, FTC Safeguards Rule, GLBA, ISO/IEC 27001 / 27002, and CIS Controls v8.
• Familiarity with the federal contracting compliance stack — DFARS 252.204-7012, 7019, 7020 and 7021, FAR 52.204-21, CUI marking and handling per 32 CFR Part 2002, and the phased CMMC rule.
• Awareness of adjacent privacy and sector regimes: U.S. state privacy laws, GDPR, NY DFS Part 500, SEC cyber disclosure obligations, and CJIS.
• Proficiency in incident response and threat mitigation strategies. 

Risk Management: 

• Ability to conduct comprehensive risk assessments and map findings to security controls.
• Experience building and maintaining remediation plans (POA&Ms) and mitigation strategies. 

Technical Tools: 

• Familiarity with cybersecurity tools and technologies (e.g., SIEM, EDR/XDR, IDS/IPS, firewalls), with Microsoft security stack experience preferred.
• Experience with GRC and compliance platforms (e.g., IntelliGRC, Vanta, Secureframe, Drata, Onetrust, FutureFeed) and evidence-collection workflows. 

Engagement Management Skills: 

• Ability to manage a high volume of concurrent client engagements (20–30 relationships) with disciplined prioritization.
• Strong scheduling and follow-through; proficiency with PSA/ticketing and project tracking tools.
• Ability to work within — and improve — standardized templates and delivery processes. 

Interpersonal Skills: 

• Excellent communication skills for interacting with client stakeholders from IT staff to executives; ability to translate technical findings into business terms.
• Ability to build and maintain strong client relationships and work effectively with coordinators and a distributed team. 

Analytical and Reporting Skills: 

• Ability to track and report on engagement metrics, compliance status, and deliverable progress.
• Proficiency in generating clear client-facing and executive-level reports.
• Expertise in monitoring regulatory compliance and refining security policies and procedures based on industry best practices. 

Professional Development: 

• Commitment to staying current on emerging trends and technologies in cybersecurity, the CMMC ecosystem, and evolving compliance requirements.
• Participation in industry training, conferences, and credential maintenance.

Pay rate starts at $95,000.00 up to $120,000.00 annually and may vary by experience and location.

• Total compensation for this role consists of two components: (1) a base component, paid as an hourly rate or annual salary, and (2) a delivery-based compensation bonus, paid monthly.
• Delivery bonus: paid monthly and calculated on the preceding month's delivery performance - delivered hours recorded in the PSA, engagement milestone completion (SSP delivery, POA&M currency, assessment readiness), and client retention and contract health across the assigned portfolio.
• Bonus targets and measurement criteria are established at hire and reviewed [annually]. Accurate and timely PSA time entry is a prerequisite for bonus calculation.
• Total compensation for this role is positioned above the standard Security Advisor band to reflect the credential, experience, and framework-depth requirements above. 

• Medical Insurance Plan
• Dental & Vision
• Life Insurance
• Disability Coverage
• Paid Time Off (starts at 15 days per year)
• Paid Maternity/Paternity Leave
• Paid US Holidays
• Retirement Plan
• Salary Advancement/Loan
• Health & Wellness Program
• Company-paid training and certification
• Supplemental Life Insurance (Employee-paid)
• Supplemental Health Plans (Employee-paid)

Intelligent Technical Solutions (ITS) has been made aware of fraudulent job postings and communications misrepresenting our company. Applicants are advised to exercise caution and apply only through official ITS channels.

• ITS does not request payment or financial information at any stage of the hiring process.
• Sensitive personal information (e.g., Social Security numbers) will not be requested prior to a formal offer.
• We have become aware of fake profiles on LinkedIn, Facebook, and other social media platforms impersonating our employees and falsely claiming to represent our company. Please exercise caution when interacting with these accounts.
• If you receive suspicious messages or requests, do not engage. Report them to [email protected]. 
• All verified job openings are posted here: https://www.itsasap.com/job-openings.

PRE-RECORDED VIDEO INTERVIEW