CMMC Compliance Analyst

Alvarez Technology Group•Salinas, CA

About The Position

Alvarez Technology Group (ATG), a managed technology and cybersecurity services company, is seeking a Compliance Analyst to deliver client-facing cybersecurity compliance, risk management, and governance services. The role works directly with customers to assess risk, evaluate compliance, develop policies and operating procedures, organize evidence, document findings, and coordinate remediation through completion. The analyst interviews technical and business stakeholders, reviews evidence, identifies control gaps, documents risk, and translates complex requirements into clear, actionable recommendations. The role also maintains internal processes, documentation, templates, GRC data, evidence standards, and workflows used to operate and improve the compliance program. This is an hourly, non-exempt position. Compensation is negotiated individually based on experience, capabilities, and contribution; the wage range is $30 to $40 per hour. Applicants must submit to a background check and provide a valid driver's license and proof of auto insurance.

Requirements

Experience in cybersecurity governance, risk management, compliance, IT audit, security assessment, or a related discipline.
Demonstrated experience conducting cybersecurity risk assessments or compliance assessments.
Experience reviewing controls and supporting evidence against defined requirements.
Experience developing cybersecurity policies, standards, operating procedures, and control documentation.
Working knowledge of NIST SP 800-171, CMMC, NIST CSF, CIS Controls, GLBA, FFIEC guidance, or comparable frameworks.
Experience documenting findings, risks, exceptions, remediation activities, and control status within a GRC process or platform.
Strong client-facing communication, facilitation, presentation, and technical writing skills.
Ability to conduct structured interviews with technical and nontechnical stakeholders.
Ability to coordinate multiple customer projects, assessments, deliverables, and deadlines.
Strong organization, follow-through, professional judgment, and attention to evidence quality.
Working knowledge of identity and access management, endpoint security, vulnerability management, logging and SIEM, network security, cloud security, Microsoft 365, and data protection.
Applicants must submit to a background check.
Applicants must have a valid driver's license and proof of auto insurance.

Nice To Haves

Experience within an MSP, MSSP, consulting, audit, or professional-services environment.
Experience working directly with regulated customers and executive stakeholders.
Experience conducting CMMC or NIST SP 800-171 readiness assessments.
Experience supporting financial institutions subject to GLBA or FFIEC expectations.
Experience preparing organizations for third-party audits or regulatory examinations.
Experience with GRC platforms used to manage controls, risks, evidence, findings, and remediation.
Familiarity with Microsoft 365, Entra ID, Intune, Defender, Sentinel, Purview, and Azure from a governance and compliance perspective.
Experience coordinating technical remediation projects with infrastructure, cloud, and security engineering teams.
A bachelor's degree in cybersecurity, information technology, information systems, business, risk management, or a related discipline is preferred; equivalent relevant professional experience is also considered.
Relevant certifications may include CISA, CRISC, CISM, CISSP, CCSP, CompTIA Security+, CMMC or Cyber-AB ecosystem credentials, and Microsoft Security, Compliance, and Identity certifications.
Demonstrated assessment capability, client-facing experience, and practical understanding of control implementation are valued alongside formal certifications.

Responsibilities

Conduct cybersecurity risk and compliance assessments for customers.
Review controls and supporting evidence against defined requirements; identify control gaps and document risk.
Develop cybersecurity policies, standards, operating procedures, and control documentation.
Organize evidence and maintain evidence quality and standards.
Document findings, risks, exceptions, remediation activities, and control status within a GRC process or platform.
Coordinate customer projects, assessments, deliverables, deadlines, and remediation activities through completion.
Conduct structured interviews with technical and nontechnical stakeholders.
Translate complex requirements into clear, actionable recommendations.
Maintain internal processes, documentation, templates, GRC data, evidence standards, and workflows for the compliance program.
Coordinate technical remediation projects with infrastructure, cloud, and security engineering teams.