Implementation Specialist, CMMC

Secureframe

. Lead end-to-end CMMC implementations from discovery and scoping through environment configuration, control validation, documentation, readiness milestones, and operational handoff .

Posted 11/9/2026full-timeNew York City • New York • United StatesJuniorMid-Level💰 $100,000 - $125,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in CMMC Level 2 implementations, Microsoft systems administration, and security engineering, with a strong focus on compliance, documentation, and customer engagement. Proficient in configuring and managing Microsoft Azure, Microsoft 365 GCC High, and security tools to ensure effective remediation and operational readiness.

Highest-signal resume keywords

CMMC Level 2 ExpertiseMicrosoft Azure AdministrationMicrosoft 365 GCC High ManagementPowerShell ProficiencyNIST SP 800-171 Implementation

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

CMMC ImplementationMicrosoft Systems AdministrationSecurity EngineeringControl MappingDocumentation PreparationEvidence CollectionMicrosoft Sentinel DeploymentMicrosoft Intune ManagementActive Directory ConfigurationHybrid Identity Management

Soft Skills

Clear CommunicationCustomer EngagementCross-Functional CollaborationProject ManagementRisk Management

Tools & Technologies

Microsoft 365 GCC HighMicrosoft AzureMicrosoft DefenderMicrosoft PurviewMicrosoft GraphSecureframePowerShellEntra IDConditional AccessMFA

Certifications & Qualifications

SC-200CCPCCAPMPCSMSecurity+CISACISMCRISCCCSK

Industry Keywords

CUI HandlingFCI HandlingITAR ComplianceDFARSFedRAMPGRC AutomationCyber Incident ReportingNetwork SecurityIncident ResponseAssessment Preparation

Tech Stack

Tools & technologies

AWSAzureCloudDNSFirewallsPMP

About the role

Key responsibilities & impact

Lead end-to-end CMMC implementations from discovery and scoping through environment configuration, control validation, documentation, readiness milestones, and operational handoff
Create implementation plans with scope, timelines, milestones, owners, risks, dependencies, and success criteria
Translate CMMC Level 2 and NIST SP 800-171 requirements into implementation tasks and execute remediation
Operationalize CUI and FCI handling, asset categorization, evidence collection, and assessment preparation
Map CUI and FCI across email, file sharing, cloud applications, endpoints, engineering systems, facilities, and third-party providers
Configure Secureframe workflows for control mapping, evidence automation, policies, procedures, owner assignments, remediation tracking, and readiness reporting
Contribute to SSPs, POA&Ms, technical documentation, control evidence, and assessment preparation
Provision, harden, and administer Microsoft 365 GCC High tenants and Azure Government resources
Configure Entra ID, Conditional Access, MFA, role-based access, PIM, Active Directory, Group Policy, DNS, hybrid identity synchronization, and Entra Domain Services
Deploy and manage Microsoft Intune for device enrollment, configuration, security baselines, endpoint compliance, encryption, applications, and patching
Implement Microsoft Sentinel connectors, log collection, analytics rules, dashboards, alert tuning, and incident-response automation
Configure Microsoft Defender and Purview for endpoint protection, vulnerability management, DLP, sensitivity labeling, and CUI protection
Support secure network configurations and coordinate firewall, VPN, segmentation, connectivity, physical controls, and non-Microsoft systems
Collaborate with Sales, Customer Success, Product, Engineering, Security, Support, CMMC partners, MSPs, consultants, auditors, and C3PAOs
Provide advisory support on CMMC scope, secure architecture, control gaps, and remediation priorities
Deliver customer training, technical working sessions, documented procedures, and operational handoffs
Build repeatable implementation assets including kickoff templates, project plans, RACI models, discovery questionnaires, evidence checklists, status reports, readiness criteria, risk registers, and handoff runbooks
Automate deployment, administration, configuration, and evidence collection using PowerShell, Microsoft Graph, and Azure tooling
Feed implementation insights back to Product, Engineering, Sales, Customer Success, and leadership

Requirements

What you’ll need

2–5 years of relevant experience in technical implementation, Microsoft systems administration, security engineering, professional or managed services, or technical consulting, including customer-facing delivery
Production experience administering Microsoft Azure, Microsoft 365 GCC High, and Windows environments
Strong knowledge of Active Directory Domain Services, Entra ID, Group Policy, DNS, hybrid identity, and Microsoft domain services
Direct experience deploying and troubleshooting Microsoft Sentinel and Intune
Experience configuring Microsoft Defender and Purview security and data-protection capabilities
Proficiency with PowerShell
Strong CMMC Level 2 expertise and hands-on experience delivering readiness or remediation engagements
Experience implementing and validating applicable NIST SP 800-171 controls, control mapping, SSPs, POA&Ms, documentation, and assessment evidence
Must qualify as a U.S. person under ITAR (22 CFR § 120.62) for work involving export-controlled customer data and environments
Ability to manage multiple customer engagements, timelines, dependencies, risks, executive visibility, and cross-functional accountability
Ability to work with customers ranging from founder-led teams to larger organizations
Clear written and verbal communication skills
Nice-to-have experience with Azure Government, AWS GovCloud, DFARS 252.204-7012, FedRAMP, ITAR, or defense contractor environments
Nice-to-have SOC monitoring, alert triage, incident investigation and response, and DFARS cyber incident reporting experience
Nice-to-have networking expertise, including firewalls, VPNs, routing, network security groups, and segmentation
Nice-to-have experience supporting C3PAO assessments, partner-assisted delivery, secure enclaves, or GRC and compliance automation platforms
Relevant certifications such as SC-200, CCP, CCA, PMP, CSM, Security+, CISA, CISM, CRISC, or CCSK are a plus

Benefits

Comp & perks

Remote-friendly work arrangement
Customer or company travel may be required for strategic implementations, team planning, or partner/customer events