Compliance Specialist

nuvioIT, LLC is a Norfolk, VA-based Managed Security Service Provider (MSSP) and CMMC Registered Practitioner Organization (RPO). We deliver managed IT, cybersecurity operations, and CMMC compliance services to Defense Industrial Base (DIB) contractors. We are a Microsoft Partner operating at the intersection of compliance-driven security and enterprise Microsoft 365 technology helping defense subcontractors achieve and maintain CMMC Level 2 certification.

We are expanding our CMMC readiness practice and are looking for a motivated compliance contractor with hands-on CMMC experience to deliver policy, documentation, and advisory work across our active DIB client engagements. This is a great opportunity for a CCP-credentialed professional building their consulting practice or looking for meaningful part-time contract work. Engagement has strong potential to grow into a long-term relationship as the practice scales.

We are looking for a CMMC Compliance Specialist on a 1099 basis to deliver compliance documentation, policy development, and advisory work for DIB clients pursuing CMMC Level 2 certification. The technical security controls are handled by nuvioIT engineers, your focus is the compliance side: SSPs, POA&Ms, policies, procedures, evidence mapping, and readiness advisory.

You will work directly with the founder and receive guidance on client context and environment details. This is a strong fit for someone 2–3 years into their CMMC career who wants real client exposure and flexibility. Current volume supports up to 20 hours per week with room to grow as the practice scales.

Job Duties

•   Conduct CMMC Level 2 gap assessments against NIST SP 800-171 Rev. 2 for assigned DIB clients

•   Author and maintain System Security Plans (SSPs) scoped to client environments including cloud, on- premises, and hybrid architectures

•   Develop and maintain Plans of Action & Milestones (POA&Ms) for identified gaps and deficiencies

•   Write, review, and finalize CMMC-required policies and procedures across all 14 control families

•   Map implemented technical controls to CMMC assessment objectives working with nuvioIT engineers to gather and validate evidence

•   Advise clients on CUI scoping, asset boundary decisions, and assessment preparation strategy

•   Support clients through the SPRS self-assessment scoring process and prepare documentation packages for C3PAO assessment

•   Coordinate with nuvioIT engineering staff to ensure technical configurations are documented and traceable to compliance requirements

•   Assist in developing nuvioIT's own internal CMMC Level 2 compliance documentation as part of the company's voluntary certification effort

•   Participate in periodic client check-ins and compliance status reviews as the compliance subject matter expert

Required Experience

•   2–3 years of hands-on CMMC, NIST SP 800-171, or DFARS compliance experience.

•   SSP authorship experience: you have written or contributed to at least one real SSP, not just reviewed a template

•   POA&M development: you understand gap identification, remediation planning, and milestone tracking

•   Policy and procedure writing: familiar with the 14 CMMC control families and what documentation each requires

•   Working knowledge of CUI scoping and asset boundary concepts, enough to guide a client conversation

•   Familiarity with SPRS scoring and what documentation is needed to support a self-assessment

•   Basic familiarity with Microsoft 365 at a compliance level and understanding how controls like MFA, DLP, and audit logging satisfy CMMC requirements

•   Comfort working within a GRC platform for evidence tracking, documentation, and control management, we use IntelliGRC

•   Active CCP (Certified CMMC Professional) is required

Preferred Experience

•   Experience supporting at least one client all the way through SPRS submission or C3PAO readiness even if not yet certified

•   Familiarity with GCC High or Microsoft 365 GCC environments at a compliance level

•   Prior MSP, RPO, or defense contractor environment experience

•   Prior hands-on experience with IntelliGRC specifically, faster ramp, preferred but not required

Why Work With Us

•   Structured engagements with defined scope, not open-ended consulting with scope creep and no boundaries

•   Potential to grow into a long-term relationship as nuvioIT scales its CMMC practice

•   Contribute to nuvioIT's own voluntary CMMC Level 2 certification, meaningful work that goes beyond client delivery

•   Flexible, remote-first engagement, work on your schedule within agreed delivery milestones

Send your resume, confirmation of active CCP credential, and a brief note on your CMMC experience, what engagements you have supported, your role in SSP or policy work to

careers@nuvioit.com

Please do not submit through staffing agencies or consulting firms. We are engaging directly with individual contractors. Applicants without an active CCP credential will not be considered.