GRC Program and CMMC Compliance Lead
About The Position
PAR Systems is seeking a GRC Program and CMMC Compliance Lead to build and mature our enterprise Governance, Risk & Compliance (GRC) program, with an initial focus on advancing PAR’s CMMC readiness and ongoing compliance. This is an opportunity to build, not simply maintain. You’ll establish practical frameworks, processes, controls, risk practices, and reporting that strengthen cybersecurity and IT governance across PAR. While CMMC is an important near-term priority, your impact will extend into a broader GRC capability supporting PAR’s enterprise risk program. You’ll partner with Information Systems, Procurement, business leaders, control owners, and external CMMC advisors to translate complex requirements into practical business expectations. This role requires the judgment to make recommendations, provide credible challenge, coach stakeholders, and validate that requirements are being met—not simply interpret regulations or manage a compliance project.
Requirements
- Three or more years of progressive experience in governance, risk, compliance, IT audit, information security, or cybersecurity compliance.
- Demonstrated hands-on experience implementing, assessing, or managing NIST SP 800-171 and/or CMMC requirements and self-assessments.
- Working knowledge of CMMC Level 2, NIST SP 800-171 Rev. 2, NIST SP 800-171A assessment objectives, DFARS 252.204-7012, and applicable CMMC contract requirements.
- Experience developing and maintaining a System Security Plan, managing Plan of Action & Milestones, control narratives, system descriptions, asset inventories, data-flow documentation, and assessment evidence.
- Working knowledge of CMMC assessment scoping, including CUI and FCI identification, system boundaries, security protection assets, shared services, cloud environments, and external service providers.
- Strong documentation and evidence-management skills, with demonstrated ability to maintain current compliance artifacts, track cybersecurity findings, coordinate remediation, and drive POA&M items through validated closure.
- Strong analytical, organizational, written, verbal, and cross-functional communication skills.
- US Person
Nice To Haves
- Experience significantly supporting a CMMC Level 2 or DFARS cybersecurity compliance program, including preparation for or participation in a C3PAO, DIBCAC, or comparable NIST-based assessment.
- Experience supporting cybersecurity requirements and flow-downs across subcontractors and suppliers, including applicable DFARS compliance obligations.
- CCP, CISA, CISSP, CRISC, CCA, or comparable certification or assessment experience.
- Knowledge or experience with third party risk management programs and reviews.
- Experience supporting organizations in defense, aerospace, nuclear, space, or other highly regulated industries.
Responsibilities
- Establish practical frameworks, processes, controls, risk practices, and reporting that strengthen cybersecurity and IT governance.
- Conduct focused cybersecurity and IT risk assessments.
- Strengthen governance practices.
- Establish useful reporting.
- Help leaders understand and respond to risk.
- Lead the NIST SP 800-171 self-assessment process.
- Validate that the SSP, POA&M, controls, and supporting evidence accurately reflect the operating environment.
- Coordinate identified gaps through resolution.
- Translate regulatory, contractual, and customer requirements into clear expectations.
- Establish accountability.
- Challenge gaps when needed.
- Help ensure PAR remains prepared for assessments and ongoing compliance as requirements and the business evolve.
Benefits
- 401(k) & matching
- Medical, Dental, Vision Insurance
- Disability & Life Insurance
- PTO, Paid Holidays, & Parental Leave for both Parents
- Tuition Reimbursement
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
