CMMC / FedRAMP Program Manager

JLL•Washington, DC

17h•$140,000 - $155,000•Onsite

About The Position

This role leads the enterprise-wide implementation of CMMC and FedRAMP compliance programs, serving as the central coordinator between IT, legal, sourcing, and executive leadership. The position manages day-to-day program execution, coordinates external assessments with third-party organizations, and establishes governance frameworks including dashboards and risk tracking.

Requirements

Bachelor's degree in a relevant field such as business, computer science, or cybersecurity.
5+ years in program management or government contracting, orchestrating cross-functional initiatives across IT, legal, and executive stakeholders.
Prior experience in a compliance or information security program environment (e.g., CMMC, FedRAMP, NIST 800-series), gained through partnering with SMEs rather than personally performing the technical work.
Working knowledge of NIST SP 800-171, NIST SP 800-172, and CMMC standards, as well as NIST SP 800-53 and the FedRAMP authorization process, sufficient to manage subject-matter experts, sequence dependent workstreams, and translate technical risk for executive stakeholders.
Strong project leadership and communication skills.
Experience with Governance, Risk, and Compliance (GRC) tools.

Nice To Haves

Experience preparing organizations for third-party or regulatory assessments.

Responsibilities

Lead the rollout of CMMC and FedRAMP program readiness strategies and implementation plans.
Act as the central coordinator between IT, legal, sourcing, and executive leadership across both the CMMC and FedRAMP programs.
Own day-to-day program orchestration — running the daily/weekly execution cadence, tracking cross-workstream dependencies, and escalating blockers before they put timelines at risk.
Prepare the enterprise for external assessments by managing internal gap analyses and remediation planning.
Liaise with Certified Third-Party Assessment Organizations (C3PAOs) for CMMC and Third-Party Assessment Organizations (3PAOs) for FedRAMP.
Establish program scorecards, executive dashboards, and risk management tracking for compliance metrics.
Drive organizational training and stakeholder engagement.
Drive adoption and ongoing maintenance of secure handling policies for Controlled Unclassified Information (CUI), developed in coordination with legal and security teams.
Lead and orchestrate the FedRAMP authorization process end-to-end, driving the schedule for System Security Plan (SSP) development and control implementation performed by technical/security SMEs against NIST SP 800-53 milestones.
Coordinate with Third-Party Assessment Organizations (3PAOs), sponsoring agencies, and the FedRAMP PMO, and manage ongoing continuous monitoring obligations post-authorization.