Compliance Manager (NIST Cybersecurity Framework Maturity Lead) (Contract)

Description

Seeking an experienced, self-directed cybersecurity contractor to serve as the NIST Cybersecurity Framework (CSF) Maturity Lead for a focused six-month engagement. This individual will own the design, execution, and documentation of our journey toward NIST CSF maturity — driving the organization from its current baseline to a defined, measurable, and sustainable maturity target. The Lead will operate with a high degree of autonomy, partnering with a junior GRC contractor and collaborating across IT, Engineering, Quality, and Regulatory functions. This is a build role: the person we hire will create the processes, tooling, and governance artifacts needed to support the program — and will be accountable for ensuring those outputs can be transitioned to internal staff at engagement close.

Requirements

What You’ll Do NIST CSF Assessment & Roadmap

• Lead a current-state assessment of company cybersecurity posture against the NIST CSF (v1.1 or v2.0) across all five Functions: Identify, Protect, Detect, Respond, and Recover.
• Establish a target maturity tier and define a prioritized, time-boxed roadmap with clear milestones within the six-month engagement window.
• Map existing controls (policies, procedures, technical safeguards) to CSF Categories and Subcategories; identify gaps and document residual risk.
• Where NIST CSF does not apply directly, leverage equivalent controls from NIST 800-53, ISO 27001, SOC 2, CMMC, or other applicable frameworks to provide crosswalk evidence. Program Governance &
  
  

Project Management

• Establish and maintain a formal program charter, RACI matrix, and weekly status reporting cadence for all NIST CSF workstreams.
• Own the program plan — maintaining tasks, owners, dependencies, and milestone dates with rigorous tracking and proactive escalation of blockers.
• Manage the junior GRC contractor: assign work, review deliverables, provide structured feedback, and ensure quality and consistency across outputs.
• Run structured stakeholder meetings, produce clear meeting notes, action registers, and decision logs.
• Maintain a living program dashboard visible to CISO and senior leadership reflecting current maturity scores, risk posture, and roadmap status.
  
  

Policy, Process & Control Development

• Draft, revise, and finalize cybersecurity policies, standards, procedures, and control narratives required to close CSF gaps.
• Design and implement repeatable processes for control execution — including access reviews, vulnerability management SLA tracking, patch governance, and control attestations.
• Develop evidence collection templates, control calendars, and checklists to support ongoing monitoring post-engagement.
• Build a governance repository (SharePoint, Confluence, or equivalent) organized for auditability and long-term operability.
  
  

Risk Management

• Maintain a cybersecurity risk register aligned to CSF subcategories, capturing likelihood, impact, ownership, and remediation status.
• Facilitate risk assessment workshops with IT, Engineering, and Quality stakeholders; document findings and drive decisions to closure.
• Identify, document, and manage exceptions; develop compensating controls where remediation timelines extend beyond engagement scope. Stakeholder Engagement & Influence
• Operate as the primary point of accountability for all NIST CSF maturity activities, working without direct authority over functional teams.
• Build trusted relationships across IT, Engineering, Quality, Legal, and Regulatory Affairs to drive compliant outcomes.
• Communicate program status, risk posture, and decisions clearly to both technical and executive audiences.
• Deliver training or awareness content to stakeholders on relevant control expectations and their responsibilities.
  
  

Transition & Knowledge Transfer

• Design all processes with handoff in mind: document workflows, runbooks, and control calendars sufficient for an internal team member to continue operating the program independently.
• Conduct formal knowledge transfer sessions in the final 30 days of the engagement.
• Produce a final engagement report summarizing maturity progress, residual gaps, and recommended next steps.
  
  

Required Experience

• 7 years of experience in cybersecurity, GRC, or a closely related field.
• Demonstrated hands-on experience leading a NIST CSF assessment, gap analysis, or maturity improvement program — OR equivalent depth in NIST 800-53, ISO 27001, SOC 2, or CMMC with proven ability to apply crosswalk to NIST CSF.
• Strong project management skills: the ability to build and manage a formal program plan, track milestones, escalate risks, and deliver consistently on schedule.
• Proven track record of working autonomously in contractor or consulting roles with minimal supervision.
• Experience managing or mentoring junior team members and reviewing their work for quality.
• Demonstrated ability to build processes and documentation from scratch that are designed to outlast the builder’s tenure.
• Experience producing executive-facing reporting (dashboards, risk summaries, status decks).
• Strong written communication skills — policies, procedures, and program documentation must be clear, concise, and audit-ready.
  
  

Preferred Qualifications

• Prior engagement in a regulated industry (medical device, pharma, financial services, defense) where compliance rigor and documentation standards are high.
• Familiarity with the NIST CSF v2.0 update and its new Govern function.
• Experience with GRC platforms (ServiceNow GRC, Archer, Drata, Vanta, or similar).
• Relevant certifications: CISM, CRISC, CGRC/CAP, CISSP, ISO 27001 Lead Implementer, or equivalent.
• Familiarity with FDA cybersecurity guidance in the context of medical device GRC (a plus, not a requirement).
  
  

Working Style Requirements

• Must be able to operate as a self-starter — define the work, not just execute it.
• Must demonstrate structured thinking: organized, methodical, detail-oriented with an eye for process quality.
• Must be comfortable with ambiguity and building structure in environments where it does not yet fully exist.
• Must communicate proactively — surfacing issues, seeking alignment, and keeping stakeholders informed without being prompted.